From c7c7b0cc7f313a861dc3f814bacd4ff81e0b9923 Mon Sep 17 00:00:00 2001 From: Daniel Breedeveld Date: Mon, 24 Jul 2017 15:20:03 +0200 Subject: [PATCH 01/49] Update microsoft-surface-data-eraser.md Just a very small typo fixed --- devices/surface/microsoft-surface-data-eraser.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/surface/microsoft-surface-data-eraser.md b/devices/surface/microsoft-surface-data-eraser.md index ef8103d135..cfda08e435 100644 --- a/devices/surface/microsoft-surface-data-eraser.md +++ b/devices/surface/microsoft-surface-data-eraser.md @@ -34,7 +34,7 @@ Compatible Surface devices include: - Surface Pro 4 -- Surface Pro3 +- Surface Pro 3 - Surface 3 From 35cefb8d64781e89eae7855fc3729eb7a5537cc8 Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Fri, 15 Sep 2017 17:05:38 -0700 Subject: [PATCH 02/49] working changes --- .../windows-defender-antivirus-compatibility.md | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md b/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md index 1d49a1e634..7b46aec73f 100644 --- a/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md +++ b/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md @@ -15,7 +15,7 @@ ms.date: 09/07/2017 --- -# Windows Defender Antivirus and third party protection products +# Windows Defender Antivirus compatibility **Applies to:** @@ -60,12 +60,10 @@ Windows Server 2016 | Windows Defender AV | No | Active mode -In the passive and automatic disabled modes, Windows Defender AV will continue to run (using the *msmpeng.exe* process), and will continue to be updated, however there will be no Windows Defender user interface, scheduled scans won't run, and Windows Defender AV will not provide real-time protection from malware. +In the passive and automatic disabled modes, Windows Defender AV will continue to run (using the *msmpeng.exe* process), and will continue to be updated, however there will be no Windows Defender user interface, scheduled scans won't run, and Windows Defender AV will not provide real-time protection from malware: -The reasons for this are twofold: - -1. If you are enrolled in Windows Defender ATP, [the service requires common information sharing from the Windows Defender AV service](../windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection.md) in order to properly monitor your devices and network for intrusion attempts and attacks. -2. If the protection offered by a third-party antivirus product goes out of date, is not updated, or stops providing real-time protection from viruses, malware, and other threats, then Windows Defender AV will automatically enable itself to ensure antivirus protection is maintained on the endpoint. +1. Passive mode is enabled if you are enrolled in Windows Defender ATP because [the service requires common information sharing from the Windows Defender AV service](../windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection.md) in order to properly monitor your devices and network for intrusion attempts and attacks. +2. Automatic disabled mode is enabled so that if the protection offered by a third-party antivirus product goes out of date, is not updated, or stops providing real-time protection from viruses, malware, and other threats, Windows Defender AV will automatically enable itself to ensure antivirus protection is maintained on the endpoint. Therefore, the Windows Defender AV service needs to update itself to ensure it has up-to-date protection coverage in case it needs to automatically enable itself. From 83a5b9440e3acb26585b5049f63a12ad0b9dc0b7 Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Mon, 18 Sep 2017 10:28:14 -0700 Subject: [PATCH 03/49] updates --- ...dic-scanning-windows-defender-antivirus.md | 103 ++++++++++++++++++ ...indows-defender-antivirus-compatibility.md | 21 ++-- ...fender-antivirus-on-windows-server-2016.md | 3 - 3 files changed, 116 insertions(+), 11 deletions(-) create mode 100644 windows/threat-protection/windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus.md diff --git a/windows/threat-protection/windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus.md new file mode 100644 index 0000000000..2f73f17890 --- /dev/null +++ b/windows/threat-protection/windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus.md @@ -0,0 +1,103 @@ +--- +title: Configure always-on real-time protection in Windows Defender AV +description: Enable and configure real-time protectoin features such as behavior monitoring, heuristics, and machine-learning in Windows Defender AV +keywords: real-time protection, rtp, machine-learning, behavior monitoring, heuristics +search.product: eADQiWindows 10XVcnh +ms.pagetype: security +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: iaanw +ms.author: iawilt +ms.date: 08/25/2017 +--- + + + +# Enable and configure Windows Defender AV always-on protection and monitoring + + + +**Applies to:** + +- Windows 10 + + +**Audience** + +- Enterprise security administrators + + +**Manageability available with** + +- Group Policy + + + + +Always-on protection consists of real-time protection, behavior monitoring, and heuristics to identify malware based on known suspicious and malicious activities. + +These activities include events such as processes making unusual changes to existing files, modifying or creating automatic startup registry keys and startup locations (also known as auto-start extensibility points, or ASEPs), and other changes to the file system or file structure. + + +## Configure and enable always-on protection + +You can configure how always-on protection works with the Group Policy settings described in this section. + +To configure these settings: + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +3. In the **Group Policy Management Editor** go to **Computer configuration**. + +4. Click **Policies** then **Administrative templates**. + +5. Expand the tree to **Windows components > Windows Defender Antivirus** and then the **Location** specified in the table below. + +6. Double-click the policy **Setting** as specified in the table below, and set the option to your desired configuration. Click **OK**, and repeat for any other settings. + + + + +Location | Setting | Description | Default setting (if not configured) +---|---|---|--- +Real-time protection | Monitor file and program activity on your computer | The AV engine makes note of any file changes (file writes, such as moves, copies, or modifications) and general program activity (programs that are opened or running and that cause other programs to run) | Enabled +Real-time protection | Scan all downloaded files and attachments | Downloaded files and attachments are automatically scanned. This operates in addition to Windows Defender SmartScreen filter, which scans files before and during downloading | Enabled +Real-time protection | Turn on process scanning whenever real-time protection is enabled | You can independently enable the AV engine to scan running processes for suspicious modifications or behaviors. This is useful if you have disabled real-time protection | Enabled +Real-time protection | Turn on behavior monitoring | The AV engine will monitor file processes, file and registry changes, and other events on your endpoints for suspicious and known malicious activity | Enabled +Real-time protection | Turn on raw volume write notifications | Information about raw volume writes will be analyzed by behavior monitoring | Enabled +Real-time protection | Define the maximum size of downloaded files and attachments to be scanned | You can define the size in kilobytes | Enabled +Real-time protection | Configure monitoring for incoming and outgoing file and program activity | Specify whether monitoring should occur on incoming, outgoing, both, or neither direction. This is relevant for Windows Server installations where you have defined specific servers or Server Roles that see large amounts of file changes in only one direction and you want to improve network performance. Note that fully updated endpoints (and servers) on a network will see little performance impact irrespective of the number or direction of file changes. | Enabled (both directions) +Scan | Turn on heuristics | Heuristic protection will disable or block suspicious activity immediately before the AV engine is asked to detect the activity | Enabled +Root | Allow antimalware service to startup with normal priority | You can lower the priority of the AV engine, which may be useful in lightweight deployments where you want to have as lean a startup process as possible. This may impact protection on the endpoint. | Enabled +Root | Allow antimalware service to remain running always | If protection updates have been disabled, you can set Windows Defender AV to still run. This lowers the protection on the endpoint. | Disabled + + + + +## Disable real-time protection +> [!WARNING] +> Disabling real-time protection will drastically reduce the protection on your endpoints and is not recommended. + +The main real-time protection capability is enabled by default, but you can disable it with Group Policy: + +**Use Group Policy to disable real-time protection:** + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +3. In the **Group Policy Management Editor** go to **Computer configuration**. + +4. Click **Policies** then **Administrative templates**. + +5. Expand the tree to **Windows components > Windows Defender Antivirus > Real-time protection**. + +6. Double-click the **Turn off real-time protection** setting and set the option to **Enabled**. Click **OK**. + + + +## Related topics + +- [Configure behavioral, heuristic, and real-time protection](configure-protection-features-windows-defender-antivirus.md) +- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) \ No newline at end of file diff --git a/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md b/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md index 7b46aec73f..663e22ca35 100644 --- a/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md +++ b/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md @@ -36,7 +36,7 @@ If you are also using Windows Defender Advanced Threat Protection, then Windows On Windows Server 2016, Windows Defender AV will not enter passive or disabled mode if you have also installed a third-party antivirus product. See [Windows Defender Antivirus on Windows Server 2016](windows-defender-antivirus-on-windows-server-2016.md) topic for key differences and management options for Windows Server installations. -The following matrix illustrates how Windows Defender AV operates when third-party antivirus products or Windows Defender ATP are also used. +The following matrix illustrates the states that Windows Defender AV will enter when third-party antivirus products or Windows Defender ATP are also used. Windows version | Antimalware protection offered by | Organization enrolled in Windows Defender ATP | Windows Defender AV state -|-|-|- @@ -58,23 +58,28 @@ Windows Server 2016 | Windows Defender AV | No | Active mode >Windows Defender is also offered for [consumer devices on Windows 8.1 and Windows Server 2012](https://technet.microsoft.com/en-us/library/dn344918#BKMK_WindowsDefender), although it does not provide enterprise-level management (or an interface on Windows Server 2012 Server Core installations). +This table describes what each of the three states do: +State | Description | Real-time protection and cloud-delivered protection | Limited periodic scanning | File scanning and detection information | Threat remediation | Threat definition updates +-|-|-|-|-|- +Passive mode | Windows Defender AV will not be used as the antivirus app, and threats will not be remediated by Windows Defender AV. Files will be scanned and reports will be provided for threat detections which are shared with the Windows Defender ATP service. | N | Y | Y | N | Y +Automatic disabled mode | Windows Defender AV will not be used as the antivirus app. Files will not be scanned and threats will not be remediated. | N | Y | N | N | N +Active mode | Windows Defender AV is used as the antivirus app on the machine. All configuration made with Configuration Manager, Group Policy, Intune, or other management products will apply. Files will be scanned and threats remediated, and detection information will be reported in your confirmation tool (such as Configuration Manager or the Windows Defender AV app on the machine itself). | Y | N | Y | Y | Y -In the passive and automatic disabled modes, Windows Defender AV will continue to run (using the *msmpeng.exe* process), and will continue to be updated, however there will be no Windows Defender user interface, scheduled scans won't run, and Windows Defender AV will not provide real-time protection from malware: +Passive mode is enabled if you are enrolled in Windows Defender ATP because [the service requires common information sharing from the Windows Defender AV service](../windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection.md) in order to properly monitor your devices and network for intrusion attempts and attacks. -1. Passive mode is enabled if you are enrolled in Windows Defender ATP because [the service requires common information sharing from the Windows Defender AV service](../windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection.md) in order to properly monitor your devices and network for intrusion attempts and attacks. -2. Automatic disabled mode is enabled so that if the protection offered by a third-party antivirus product goes out of date, is not updated, or stops providing real-time protection from viruses, malware, and other threats, Windows Defender AV will automatically enable itself to ensure antivirus protection is maintained on the endpoint. +Automatic disabled mode is enabled so that if the protection offered by a third-party antivirus product goes out of date, is not updated, or stops providing real-time protection from viruses, malware, and other threats, Windows Defender AV will automatically enable itself to ensure antivirus protection is maintained on the endpoint. It also allows you to enable [limited periodic scanning](limited-periodic-scanning-windows-defender-antivirus.md), which uses the Windows Defender AV engine to periodically check for threats in addition to your main antivirus app. - Therefore, the Windows Defender AV service needs to update itself to ensure it has up-to-date protection coverage in case it needs to automatically enable itself. +In passive and automatic disabled mode, you can still [manage updates for Windows Defender](manage-updates-baselines-windows-defender-antivirus.md), however you can't move Windows Defender AV into the normal active mode if your endpoints have an up-to-date third-party product providing real-time protection from malware. - You can still [manage updates for Windows Defender](manage-updates-baselines-windows-defender-antivirus.md), however you can't move Windows Defender AV into the normal active mode if your endpoints have an up-to-date third-party product providing real-time protection from malware. - - If you uninstall the other product, and choose to use Windows Defender AV to provide protection to your endpoints, Windows Defender AV will automatically return to its normal active mode. + If you uninstall the other product, and choose to use Windows Defender AV to provide protection to your endpoints, Windows Defender AV will automatically return to its normal active mode. >[!WARNING] >You should not attempt to disable, stop, or modify any of the associated services used by Windows Defender AV, Windows Defender ATP, or the Windows Defender Security Center app. > >This includes the *wscsvc*, *SecurityHealthService*, *MsSense*, *Sense*, *WinDefend*, or *MsMpEng* services and process. Manually modifying these services can cause severe instability on your endpoints and open your network to infections and attacks. +> +>It can also cause problems when using third-party antivirus apps and how their information is displayed in the [Windows Defender Security Center app](windows-defender-security-center-antivirus.md). ## Related topics diff --git a/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md b/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md index 77b79508b8..1c459208be 100644 --- a/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md +++ b/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md @@ -144,8 +144,6 @@ By default, Windows Update does not download and install updates automatically o To ensure that protection from malware is maintained, we recommend that you enable the following services: -- Windows Defender Network Inspection service - - Windows Error Reporting service - Windows Update service @@ -155,7 +153,6 @@ The following table lists the services for Windows Defender and the dependent se |Service Name|File Location|Description| |--------|---------|--------| |Windows Defender Service (Windefend)|C:\Program Files\Windows Defender\MsMpEng.exe|This is the main Windows Defender Antivirus service that needs to be running at all times.| -|Windows Defender Network Inspection Service (Wdnissvc)|C:\Program Files\Windows Defender\NisSrv.exe|This service is invoked when Windows Defender Antivirus encounters a trigger to load it.| |Windows Error Reporting Service (Wersvc)|C:\WINDOWS\System32\svchost.exe -k WerSvcGroup|This service sends error reports back to Microsoft.| |Windows Firewall (MpsSvc)|C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork|We recommend leaving the Windows Firewall service enabled.| |Windows Update (Wuauserv)|C:\WINDOWS\system32\svchost.exe -k netsvcs|Windows Update is needed to get definition updates and antimalware engine updates| From 6dc218d2ae810aa97a2a7f6030b112de518f2f70 Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Mon, 18 Sep 2017 13:09:20 -0700 Subject: [PATCH 04/49] updates for compat and custom notifs --- ...-first-sight-windows-defender-antivirus.md | 2 +- .../images/svg/check-no.md | 7 +++ .../images/svg/check-yes.md | 7 +++ ...indows-defender-antivirus-compatibility.md | 16 ++++- ...fender-antivirus-on-windows-server-2016.md | 2 +- ...dows-defender-security-center-antivirus.md | 2 +- .../windows-defender-security-center.md | 63 +++++++++++-------- 7 files changed, 68 insertions(+), 31 deletions(-) create mode 100644 windows/threat-protection/windows-defender-antivirus/images/svg/check-no.md create mode 100644 windows/threat-protection/windows-defender-antivirus/images/svg/check-yes.md diff --git a/windows/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md index 01bec5d98d..258a939423 100644 --- a/windows/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md +++ b/windows/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md @@ -34,7 +34,7 @@ ms.date: 08/25/2017 - Windows Defender Security Center app -Block at First Sight is a feature of Windows Defender Antivirus cloud-delivered protection that provides a way to detect and block new malware within seconds. +Block at first sight is a feature of Windows Defender Antivirus cloud-delivered protection that provides a way to detect and block new malware within seconds. It is enabled by default when certain pre-requisite settings are also enabled. In most cases, these pre-requisite settings are also enabled by default, so the feature is running without any intervention. You can use group policy settings to confirm the feature is enabled. diff --git a/windows/threat-protection/windows-defender-antivirus/images/svg/check-no.md b/windows/threat-protection/windows-defender-antivirus/images/svg/check-no.md new file mode 100644 index 0000000000..afa7a3d27d --- /dev/null +++ b/windows/threat-protection/windows-defender-antivirus/images/svg/check-no.md @@ -0,0 +1,7 @@ + + Check mark no + + \ No newline at end of file diff --git a/windows/threat-protection/windows-defender-antivirus/images/svg/check-yes.md b/windows/threat-protection/windows-defender-antivirus/images/svg/check-yes.md new file mode 100644 index 0000000000..4dd10553c4 --- /dev/null +++ b/windows/threat-protection/windows-defender-antivirus/images/svg/check-yes.md @@ -0,0 +1,7 @@ + + Check mark yes + + \ No newline at end of file diff --git a/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md b/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md index 663e22ca35..aed2016cfd 100644 --- a/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md +++ b/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md @@ -60,17 +60,29 @@ Windows Server 2016 | Windows Defender AV | No | Active mode This table describes what each of the three states do: +State | Description | Real-time protection and cloud-delivered protection | Limited periodic scanning | File scanning and detection information | Threat remediation | Threat definition updates +-|-|-|-|-|-|- +Passive mode | Windows Defender AV will not be used as the antivirus app, and threats will not be remediated by Windows Defender AV. Files will be scanned and reports will be provided for threat detections which are shared with the Windows Defender ATP service. | [!include[Check mark no](images/svg/check-no.md)] | [!include[Check mark yes](images/svg/check-yes.md)] | [!include[Check mark yes](images/svg/check-yes.md)] | [!include[Check mark no](images/svg/check-no.md)] | [!include[Check mark yes](images/svg/check-yes.md)] +Automatic disabled mode | Windows Defender AV will not be used as the antivirus app. Files will not be scanned and threats will not be remediated. | [!include[Check mark no](images/svg/check-no.md)] | [!include[Check mark yes](images/svg/check-yes.md)] | [!include[Check mark no](images/svg/check-no.md)] | [!include[Check mark no](images/svg/check-no.md)] | [!include[Check mark no](images/svg/check-no.md)] +Active mode | Windows Defender AV is used as the antivirus app on the machine. All configuration made with Configuration Manager, Group Policy, Intune, or other management products will apply. Files will be scanned and threats remediated, and detection information will be reported in your confirmation tool (such as Configuration Manager or the Windows Defender AV app on the machine itself). | [!include[Check mark yes](images/svg/check-yes.md)] | [!include[Check mark no](images/svg/check-no.md)] | [!include[Check mark yes](images/svg/check-yes.md)] | [!include[Check mark yes](images/svg/check-yes.md)] | [!include[Check mark yes](images/svg/check-yes.md)] + + + + + State | Description | Real-time protection and cloud-delivered protection | Limited periodic scanning | File scanning and detection information | Threat remediation | Threat definition updates -|-|-|-|-|- -Passive mode | Windows Defender AV will not be used as the antivirus app, and threats will not be remediated by Windows Defender AV. Files will be scanned and reports will be provided for threat detections which are shared with the Windows Defender ATP service. | N | Y | Y | N | Y +Passive mode | Windows Defender AV will not be used as the antivirus app, and threats will not be remediated by Windows Defender AV. Files will be scanned and reports will be provided for threat detections which are shared with the Windows Defender ATP service. | [!include[Check mark no](images/svg/check-no.md)]N | Y | Y | N | Y Automatic disabled mode | Windows Defender AV will not be used as the antivirus app. Files will not be scanned and threats will not be remediated. | N | Y | N | N | N Active mode | Windows Defender AV is used as the antivirus app on the machine. All configuration made with Configuration Manager, Group Policy, Intune, or other management products will apply. Files will be scanned and threats remediated, and detection information will be reported in your confirmation tool (such as Configuration Manager or the Windows Defender AV app on the machine itself). | Y | N | Y | Y | Y + + Passive mode is enabled if you are enrolled in Windows Defender ATP because [the service requires common information sharing from the Windows Defender AV service](../windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection.md) in order to properly monitor your devices and network for intrusion attempts and attacks. Automatic disabled mode is enabled so that if the protection offered by a third-party antivirus product goes out of date, is not updated, or stops providing real-time protection from viruses, malware, and other threats, Windows Defender AV will automatically enable itself to ensure antivirus protection is maintained on the endpoint. It also allows you to enable [limited periodic scanning](limited-periodic-scanning-windows-defender-antivirus.md), which uses the Windows Defender AV engine to periodically check for threats in addition to your main antivirus app. -In passive and automatic disabled mode, you can still [manage updates for Windows Defender](manage-updates-baselines-windows-defender-antivirus.md), however you can't move Windows Defender AV into the normal active mode if your endpoints have an up-to-date third-party product providing real-time protection from malware. +In passive and automatic disabled mode, you can still [manage updates for Windows Defender AV](manage-updates-baselines-windows-defender-antivirus.md), however you can't move Windows Defender AV into the normal active mode if your endpoints have an up-to-date third-party product providing real-time protection from malware. If you uninstall the other product, and choose to use Windows Defender AV to provide protection to your endpoints, Windows Defender AV will automatically return to its normal active mode. diff --git a/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md b/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md index 1c459208be..c1cedd3d5d 100644 --- a/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md +++ b/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md @@ -154,7 +154,7 @@ The following table lists the services for Windows Defender and the dependent se |--------|---------|--------| |Windows Defender Service (Windefend)|C:\Program Files\Windows Defender\MsMpEng.exe|This is the main Windows Defender Antivirus service that needs to be running at all times.| |Windows Error Reporting Service (Wersvc)|C:\WINDOWS\System32\svchost.exe -k WerSvcGroup|This service sends error reports back to Microsoft.| -|Windows Firewall (MpsSvc)|C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork|We recommend leaving the Windows Firewall service enabled.| +|Windows Defender Firewall (MpsSvc)|C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork|We recommend leaving the Windows Defender Firewall service enabled.| |Windows Update (Wuauserv)|C:\WINDOWS\system32\svchost.exe -k netsvcs|Windows Update is needed to get definition updates and antimalware engine updates| diff --git a/windows/threat-protection/windows-defender-antivirus/windows-defender-security-center-antivirus.md b/windows/threat-protection/windows-defender-antivirus/windows-defender-security-center-antivirus.md index 495cc05eec..99ebbdf36d 100644 --- a/windows/threat-protection/windows-defender-antivirus/windows-defender-security-center-antivirus.md +++ b/windows/threat-protection/windows-defender-antivirus/windows-defender-security-center-antivirus.md @@ -38,7 +38,7 @@ In Windows 10, version 1703 (also known as the Creators Update), the Windows Def Settings that were previously part of the Windows Defender client and main Windows Settings have been combined and moved to the new app, which is installed by default as part of Windows 10, version 1703. > [!IMPORTANT] -> Disabling the Windows Security Center service will not disable Windows Defender AV or [Windows Firewall](https://docs.microsoft.com/en-us/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security). These will be disabled automatically when a third-party antivirus or firewall product is installed and kept up to date. +> Disabling the Windows Security Center service will not disable Windows Defender AV or [Windows Defender Firewall](https://docs.microsoft.com/en-us/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security). These will be disabled automatically when a third-party antivirus or firewall product is installed and kept up to date. > [!WARNING] > If you do disable the Windows Security Center service, or configure its associated Group Policy settings to prevent it from starting or running, the Windows Defender Security Center may display stale or inaccurate information about any antivirus or firewall products you have installed on the device. diff --git a/windows/threat-protection/windows-defender-security-center/windows-defender-security-center.md b/windows/threat-protection/windows-defender-security-center/windows-defender-security-center.md index 804c2d9152..5bc79e341c 100644 --- a/windows/threat-protection/windows-defender-security-center/windows-defender-security-center.md +++ b/windows/threat-protection/windows-defender-security-center/windows-defender-security-center.md @@ -29,25 +29,20 @@ ms.date: 08/25/2017 In Windows 10, version 1703 we introduced the new Windows Defender Security Center app, which brings together common Windows security features into one easy-to-use app. - - - ![Screen shot of the Windows Defender Security Center app showing that the device is protected and five icons for each of the features](images/security-center-home.png) - - Many settings that were previously part of the individual features and main Windows Settings have been combined and moved to the new app, which is installed out-of-the-box as part of Windows 10, version 1703. The app includes the settings and status for the following security features: - Virus & threat protection, including settings for Windows Defender Antivirus and Controlled folder access - Device performance & health, which includes information about drivers, storage space, and general Windows Update issues -- Firewall & network protection, including Windows Firewall +- Firewall & network protection, including Windows Defender Firewall - App & browser control, covering Windows Defender SmartScreen settings and Exploit protection mitigations -- Family options, which include a number of parental controls along with tips and information for keeping kids safe online - +- Family options, which includes access to parental controls along with tips and information for keeping kids safe online +In Windows 10, version 1709, we increased the scope of the app to also show information from third-party antivirus and firewall apps. The Windows Defender Security Center app uses the [Security Center service](https://technet.microsoft.com/en-us/library/bb457154.aspx#EDAA) to provide the status and information on third-party antivirus and firewall products that are installed on the device. @@ -55,13 +50,13 @@ The Windows Defender Security Center app uses the [Security Center service](http >[!IMPORTANT] >Windows Defender AV and the Windows Defender Security Center app use similarly named services for specific purposes. > ->The Windows Defender Security Center app uses the Windows Defender Security Center Service (*SecurityHealthService* or *Windows Security Health Servce*), which in turn utilizes the Security Center service ([*wscsvc*](https://technet.microsoft.com/en-us/library/bb457154.aspx#EDAA)) to ensure the app provides the most up-to-date information about the protection status on the endpoint, including protection offered by third-party antivirus products, Windows Firewall, and other security protection. +>The Windows Defender Security Center app uses the Windows Defender Security Center Service (*SecurityHealthService* or *Windows Security Health Servce*), which in turn utilizes the Security Center service ([*wscsvc*](https://technet.microsoft.com/en-us/library/bb457154.aspx#EDAA)) to ensure the app provides the most up-to-date information about the protection status on the endpoint, including protection offered by third-party antivirus products, Windows Defender Firewall, and other security protection. > >These services do not affect the state of Windows Defender AV. Disabling or modifying these services will not disable Windows Defender AV, and will lead to a lowered protection state on the endpoint, even if you are using a third-party antivirus product. > >Windows Defender AV will be [disabled automatically when a third-party antivirus product is installed and kept up to date](../windows-defender-antivirus/windows-defender-antivirus-compatibility.md). > ->Disabling the Windows Security Center service will not disable Windows Defender AV or [Windows Firewall](https://docs.microsoft.com/en-us/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security). +>Disabling the Windows Security Center service will not disable Windows Defender AV or [Windows Defender Firewall](https://docs.microsoft.com/en-us/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security). > [!WARNING] > If you disable the Security Center service, or configure its associated Group Policy settings to prevent it from starting or running, the Windows Defender Security Center app may display stale or inaccurate information about any antivirus or firewall products you have installed on the device. @@ -97,9 +92,12 @@ Disabling any of the individual features (through Group Policy or other manageme > [!IMPORTANT] > Individually disabling any of the services will not disable the other services or the Windows Defender Security Center app. -For example, [using a third-party antivirus will disable Windows Defender Antivirus](https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus). However, the Windows Defender Security Center app will still run, show its icon in the taskbar, and display information about the other features, such as Windows Defender SmartScreen and Windows Firewall. +For example, using a third-party antivirus will disable Windows Defender Antivirus. However, the Windows Defender Security Center app will still run, show its icon in the taskbar, and display information about the other features, such as Windows Defender SmartScreen and Windows Defender Firewall. + +The presence of the third-party antivirus will be indicated under the **Virus & threat protection** section and third-party firewalls will be shown under the **Firewall & network protection** section in the Windows Defender Security Center app. + +See the [Windows Defender Antivirus compatibility](https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility) topic for more information on how Windows Defender AV works with other antivirus apps, and what options are availble. -The presence of the third-party antivirus will be indicated under the **Virus & threat protection** section in the Windows Defender Security Center app. @@ -112,32 +110,38 @@ See the following links for more information on the features in the Windows Defe - Device performance & health - It administrators and IT pros can [configure the Load and unload device drivers security policy setting](https://docs.microsoft.com/en-us/windows/device-security/security-policy-settings/load-and-unload-device-drivers), and learn how to [deploy drivers during Windows 10 deployment using System Center Configuration Manager](https://docs.microsoft.com/en-us/windows/deployment/deploy-windows-sccm/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager) - Home users can learn more at the [Track your device and performance health in Windows Defender Security Center topic at support.microsoft.com](https://support.microsoft.com/en-us/help/4012986/windows-defender-track-your-device-performance-health) -- Windows Firewall - - IT administrators and IT pros can get configuration guidance from the [Windows Firewall with Advanced Security documentation library](https://docs.microsoft.com/en-us/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security) +- Windows Defender Firewall + - IT administrators and IT pros can get configuration guidance from the [Windows Defender Firewall with Advanced Security documentation library](https://docs.microsoft.com/en-us/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security) - Home users can learn more at the [Firewall & network protection in Windows Defender Security Center topic at support.microsoft.com](https://support.microsoft.com/en-us/help/4012988/windows-10-firewall-network-protection-windows-defender-security-center) - Windows Defender SmartScreen - IT administrators and IT pros can get configuration guidance from the [Windows Defender SmartScreen documentation library](https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview) - Home users can learn more at the [App & browser control in Windows Defender Security Center topic at support.microsoft.com](https://support.microsoft.com/en-us/help/4013218/windows-10-app-browser-control-in-windows-defender) -- Family options, which include a number of parental controls along with tips and information for keeping kids safe online +- Family options, which includes access to parental controls along with tips and information for keeping kids safe online - Home users can learn more at the [Help protection your family online in Windows Defender Security Center topic at support.microsoft.com](https://support.microsoft.com/en-us/help/4013209/windows-10-protect-your-family-online-in-windows-defender) -## Customize notifications from the Windows Defender Security Center + +## Customize the Windows Defender Security Center app for your organization -You can customize notifcations so they show information to users about how to get more help from your organization's help desk. - -![](images/security-center-custom-notif.png) - -This information will also appear as a pop-out window on the Windows Defender Security Center app. +You can add information about your organization in a contact card to the Windows Defender Security Center app. This can include a link to a support site, a phone number for a help desk, and an email address for email-based support. ![](images/security-center-custom-flyout.png) -Users can click on the displayed information to get more help: +This information will also be shown in some enterprise-specific notifications (including those for [Windows Defender Exploit Guard](/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md), the [Block at first sight feature](/windows/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md), and [potentially unwanted applications](/windows/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md). + +![](images/security-center-custom-notif.png) + + +Users can click on the displayed information to easily initiate a support request: - Clicking **Call** or the phone number will open Skype to start a call to the displayed number - Clicking **Email** or the email address will create a new email in the machine's default email app address to the displayed email - Clicking **Help portal** or the website URL will open the machine's default web browser and go to the displayed address -### Use Group Policy to customize the notification +### Use Group Policy to enable and customize contact information + +There are two stages to using the contact card and customized notifications. First, you have to enable the contact card or custom notifications (or both), and then you must specify at least a name for your organization and one piece of contact information. + +This can only be done in Group Policy. 1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. @@ -147,11 +151,15 @@ Users can click on the displayed information to get more help: 5. Expand the tree to **Windows components > Windows Defender Security Center > Enterprise Customization**. -6. Open the **Configure customized contact information** setting and set it to **Enabled**. Click **OK**. +6. You enable the contact card and the customized notifications by configuring two separate Group Policy settings. They will both use the same source of information (explained in Steps 7 and 8), and you can enable both or only one or the other: -7. Open the **Specify contact company name** setting and set it to **Enabled**. Enter your company or organization's name in the field in the **Options** section. Click **OK**. + 1. To enable the contact card, open the **Configure customized contact information** setting and set it to **Enabled**. Click **OK**. -8. To ensure the custom notification appear, you must also configure at least one of the following settings by opening them, setting them to **Enabled** and adding the contact information in the field under **Options**: + 2. To enable the customized notifications, open the **Configure customized notifications** setting and set it to **Enabled**. Click **OK**. + +7. After you've enabled the contact card or the customized notifications (or both), you must configure the **Specify contact company name** to **Enabled**. Enter your company or organization's name in the field in the **Options** section. Click **OK**. + +8. To ensure the custom notifications or contact card appear, you must also configure at least one of the following settings by opening them, setting them to **Enabled** and adding the contact information in the field under **Options**: 1. Specify contact email address of Email ID 2. Specify contact phone number or Skype ID 3. Specify contact website @@ -159,6 +167,9 @@ Users can click on the displayed information to get more help: 9. Click **OK** after configuring each setting to save your changes. +>[!IMPORTANT] +>You must specify the contact company name and at least one contact method - email, phone number, or website URL. If you do not specify the contact name and a contact method the customization will not apply: the contact card will not show, and notifications will not be customized. + >[!NOTE] >The Windows Defender Security Center app is a client interface on Windows 10, version 1703. It is not the Windows Defender Security Center web portal that is used to review and manage [Windows Defender Advanced Threat Protection](https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection). From d0665facf95bd197a91b3588eed8503f8a05f9c6 Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Mon, 18 Sep 2017 15:27:27 -0700 Subject: [PATCH 05/49] add WDSC topics --- ...indows-defender-antivirus-compatibility.md | 12 -- .../wdsc-app-browser-control.md | 3 + .../wdsc-customize-contact-information.md | 53 ++++++ .../wdsc-device-performance-health.md | 3 + .../wdsc-family-options.md | 2 + .../wdsc-firewall-network-protection.md | 3 + .../wdsc-hide-notifications.md | 0 .../wdsc-virus-threat-protection.md | 0 .../windows-defender-security-center.md | 158 ++++++------------ 9 files changed, 114 insertions(+), 120 deletions(-) create mode 100644 windows/threat-protection/windows-defender-security-center/wdsc-app-browser-control.md create mode 100644 windows/threat-protection/windows-defender-security-center/wdsc-customize-contact-information.md create mode 100644 windows/threat-protection/windows-defender-security-center/wdsc-device-performance-health.md create mode 100644 windows/threat-protection/windows-defender-security-center/wdsc-family-options.md create mode 100644 windows/threat-protection/windows-defender-security-center/wdsc-firewall-network-protection.md create mode 100644 windows/threat-protection/windows-defender-security-center/wdsc-hide-notifications.md create mode 100644 windows/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection.md diff --git a/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md b/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md index aed2016cfd..0235f43e85 100644 --- a/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md +++ b/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md @@ -66,18 +66,6 @@ Passive mode | Windows Defender AV will not be used as the antivirus app, and th Automatic disabled mode | Windows Defender AV will not be used as the antivirus app. Files will not be scanned and threats will not be remediated. | [!include[Check mark no](images/svg/check-no.md)] | [!include[Check mark yes](images/svg/check-yes.md)] | [!include[Check mark no](images/svg/check-no.md)] | [!include[Check mark no](images/svg/check-no.md)] | [!include[Check mark no](images/svg/check-no.md)] Active mode | Windows Defender AV is used as the antivirus app on the machine. All configuration made with Configuration Manager, Group Policy, Intune, or other management products will apply. Files will be scanned and threats remediated, and detection information will be reported in your confirmation tool (such as Configuration Manager or the Windows Defender AV app on the machine itself). | [!include[Check mark yes](images/svg/check-yes.md)] | [!include[Check mark no](images/svg/check-no.md)] | [!include[Check mark yes](images/svg/check-yes.md)] | [!include[Check mark yes](images/svg/check-yes.md)] | [!include[Check mark yes](images/svg/check-yes.md)] - - - - -State | Description | Real-time protection and cloud-delivered protection | Limited periodic scanning | File scanning and detection information | Threat remediation | Threat definition updates --|-|-|-|-|- -Passive mode | Windows Defender AV will not be used as the antivirus app, and threats will not be remediated by Windows Defender AV. Files will be scanned and reports will be provided for threat detections which are shared with the Windows Defender ATP service. | [!include[Check mark no](images/svg/check-no.md)]N | Y | Y | N | Y -Automatic disabled mode | Windows Defender AV will not be used as the antivirus app. Files will not be scanned and threats will not be remediated. | N | Y | N | N | N -Active mode | Windows Defender AV is used as the antivirus app on the machine. All configuration made with Configuration Manager, Group Policy, Intune, or other management products will apply. Files will be scanned and threats remediated, and detection information will be reported in your confirmation tool (such as Configuration Manager or the Windows Defender AV app on the machine itself). | Y | N | Y | Y | Y - - - Passive mode is enabled if you are enrolled in Windows Defender ATP because [the service requires common information sharing from the Windows Defender AV service](../windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection.md) in order to properly monitor your devices and network for intrusion attempts and attacks. Automatic disabled mode is enabled so that if the protection offered by a third-party antivirus product goes out of date, is not updated, or stops providing real-time protection from viruses, malware, and other threats, Windows Defender AV will automatically enable itself to ensure antivirus protection is maintained on the endpoint. It also allows you to enable [limited periodic scanning](limited-periodic-scanning-windows-defender-antivirus.md), which uses the Windows Defender AV engine to periodically check for threats in addition to your main antivirus app. diff --git a/windows/threat-protection/windows-defender-security-center/wdsc-app-browser-control.md b/windows/threat-protection/windows-defender-security-center/wdsc-app-browser-control.md new file mode 100644 index 0000000000..74061fcac7 --- /dev/null +++ b/windows/threat-protection/windows-defender-security-center/wdsc-app-browser-control.md @@ -0,0 +1,3 @@ +- Windows Defender SmartScreen + - IT administrators and IT pros can get configuration guidance from the [Windows Defender SmartScreen documentation library](https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview) + - Home users can learn more at the [App & browser control in Windows Defender Security Center topic at support.microsoft.com](https://support.microsoft.com/en-us/help/4013218/windows-10-app-browser-control-in-windows-defender) \ No newline at end of file diff --git a/windows/threat-protection/windows-defender-security-center/wdsc-customize-contact-information.md b/windows/threat-protection/windows-defender-security-center/wdsc-customize-contact-information.md new file mode 100644 index 0000000000..602bdeba23 --- /dev/null +++ b/windows/threat-protection/windows-defender-security-center/wdsc-customize-contact-information.md @@ -0,0 +1,53 @@ + + +## Customize the Windows Defender Security Center app for your organization + +You can add information about your organization in a contact card to the Windows Defender Security Center app. This can include a link to a support site, a phone number for a help desk, and an email address for email-based support. + +![](images/security-center-custom-flyout.png) + +This information will also be shown in some enterprise-specific notifications (including those for [Windows Defender Exploit Guard](/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md), the [Block at first sight feature](/windows/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md), and [potentially unwanted applications](/windows/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md). + +![](images/security-center-custom-notif.png) + + +Users can click on the displayed information to easily initiate a support request: +- Clicking **Call** or the phone number will open Skype to start a call to the displayed number +- Clicking **Email** or the email address will create a new email in the machine's default email app address to the displayed email +- Clicking **Help portal** or the website URL will open the machine's default web browser and go to the displayed address + + +### Use Group Policy to enable and customize contact information + +There are two stages to using the contact card and customized notifications. First, you have to enable the contact card or custom notifications (or both), and then you must specify at least a name for your organization and one piece of contact information. + +This can only be done in Group Policy. + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +3. In the **Group Policy Management Editor** go to **Computer configuration**. + +4. Click **Policies** then **Administrative templates**. + +5. Expand the tree to **Windows components > Windows Defender Security Center > Enterprise Customization**. + +6. You enable the contact card and the customized notifications by configuring two separate Group Policy settings. They will both use the same source of information (explained in Steps 7 and 8), and you can enable both or only one or the other: + + 1. To enable the contact card, open the **Configure customized contact information** setting and set it to **Enabled**. Click **OK**. + + 2. To enable the customized notifications, open the **Configure customized notifications** setting and set it to **Enabled**. Click **OK**. + +7. After you've enabled the contact card or the customized notifications (or both), you must configure the **Specify contact company name** to **Enabled**. Enter your company or organization's name in the field in the **Options** section. Click **OK**. + +8. To ensure the custom notifications or contact card appear, you must also configure at least one of the following settings by opening them, setting them to **Enabled** and adding the contact information in the field under **Options**: + 1. **Specify contact email address or Email ID** + 2. **Specify contact phone number or Skype ID** + 3. **Specify contact website** + +9. Click **OK** after configuring each setting to save your changes. + + +>[!IMPORTANT] +>You must specify the contact company name and at least one contact method - email, phone number, or website URL. If you do not specify the contact name and a contact method the customization will not apply: the contact card will not show, and notifications will not be customized. + + diff --git a/windows/threat-protection/windows-defender-security-center/wdsc-device-performance-health.md b/windows/threat-protection/windows-defender-security-center/wdsc-device-performance-health.md new file mode 100644 index 0000000000..a2ad85bc83 --- /dev/null +++ b/windows/threat-protection/windows-defender-security-center/wdsc-device-performance-health.md @@ -0,0 +1,3 @@ +- Device performance & health + - It administrators and IT pros can [configure the Load and unload device drivers security policy setting](https://docs.microsoft.com/en-us/windows/device-security/security-policy-settings/load-and-unload-device-drivers), and learn how to [deploy drivers during Windows 10 deployment using System Center Configuration Manager](https://docs.microsoft.com/en-us/windows/deployment/deploy-windows-sccm/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager) + - Home users can learn more at the [Track your device and performance health in Windows Defender Security Center topic at support.microsoft.com](https://support.microsoft.com/en-us/help/4012986/windows-defender-track-your-device-performance-health) \ No newline at end of file diff --git a/windows/threat-protection/windows-defender-security-center/wdsc-family-options.md b/windows/threat-protection/windows-defender-security-center/wdsc-family-options.md new file mode 100644 index 0000000000..f6b1ad952c --- /dev/null +++ b/windows/threat-protection/windows-defender-security-center/wdsc-family-options.md @@ -0,0 +1,2 @@ +- Family options, which includes access to parental controls along with tips and information for keeping kids safe online + - Home users can learn more at the [Help protection your family online in Windows Defender Security Center topic at support.microsoft.com](https://support.microsoft.com/en-us/help/4013209/windows-10-protect-your-family-online-in-windows-defender) \ No newline at end of file diff --git a/windows/threat-protection/windows-defender-security-center/wdsc-firewall-network-protection.md b/windows/threat-protection/windows-defender-security-center/wdsc-firewall-network-protection.md new file mode 100644 index 0000000000..472ddc118c --- /dev/null +++ b/windows/threat-protection/windows-defender-security-center/wdsc-firewall-network-protection.md @@ -0,0 +1,3 @@ +- Windows Defender Firewall + - IT administrators and IT pros can get configuration guidance from the [Windows Defender Firewall with Advanced Security documentation library](https://docs.microsoft.com/en-us/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security) + - Home users can learn more at the [Firewall & network protection in Windows Defender Security Center topic at support.microsoft.com](https://support.microsoft.com/en-us/help/4012988/windows-10-firewall-network-protection-windows-defender-security-center) diff --git a/windows/threat-protection/windows-defender-security-center/wdsc-hide-notifications.md b/windows/threat-protection/windows-defender-security-center/wdsc-hide-notifications.md new file mode 100644 index 0000000000..e69de29bb2 diff --git a/windows/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection.md b/windows/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection.md new file mode 100644 index 0000000000..e69de29bb2 diff --git a/windows/threat-protection/windows-defender-security-center/windows-defender-security-center.md b/windows/threat-protection/windows-defender-security-center/windows-defender-security-center.md index 5bc79e341c..0586d8a2b4 100644 --- a/windows/threat-protection/windows-defender-security-center/windows-defender-security-center.md +++ b/windows/threat-protection/windows-defender-security-center/windows-defender-security-center.md @@ -27,43 +27,35 @@ ms.date: 08/25/2017 -In Windows 10, version 1703 we introduced the new Windows Defender Security Center app, which brings together common Windows security features into one easy-to-use app. +In Windows 10, version 1703 we introduced the new Windows Defender Security Center app, which brings together common Windows security features into one app. + ![Screen shot of the Windows Defender Security Center app showing that the device is protected and five icons for each of the features](images/security-center-home.png) -Many settings that were previously part of the individual features and main Windows Settings have been combined and moved to the new app, which is installed out-of-the-box as part of Windows 10, version 1703. +Many settings that were previously part of the individual features and main Windows Settings have been combined and moved to the new app, which is installed out-of-the-box as part of Windows 10, version 1703. In Windows 10, version 1709, we increased the scope of the app to also show information from third-party antivirus and firewall apps. -The app includes the settings and status for the following security features: +>[!NOTE] +>The Windows Defender Security Center app is a client interface on Windows 10, version 1703. It is not the Windows Defender Security Center web portal console that is used to review and manage [Windows Defender Advanced Threat Protection](https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection). -- Virus & threat protection, including settings for Windows Defender Antivirus and Controlled folder access -- Device performance & health, which includes information about drivers, storage space, and general Windows Update issues -- Firewall & network protection, including Windows Defender Firewall -- App & browser control, covering Windows Defender SmartScreen settings and Exploit protection mitigations -- Family options, which includes access to parental controls along with tips and information for keeping kids safe online +This library describes the Windows defender Security Center app, and provides information on configuring certain features, inlcuding: -In Windows 10, version 1709, we increased the scope of the app to also show information from third-party antivirus and firewall apps. + +- [Showing and customizing contact information on the app and in notifications](wdsc-customize-contact-information.md) +- [Hiding notifications](wdsc-hide-notifications.md) + +You can find more information about each section, including options for configuring the sections - such as hiding each of the sections - at the following topics: + + +- [Virus & threat protection](wdsc-virus-threat-protection.md), which has information and access to antivirus settings and the Controlled folder access feature of Windows Defender Exploit Guard +- [Device performance & health](wdsc-device-performance-health.md), which has information about drivers, storage space, and general Windows Update issues +- [Firewall & network protection](wdsc-firewall-network-protection.md), which has information and access to firewall settings, including Windows Defender Firewall +- [App & browser control](wdsc-app-browser-control.md), covering Windows Defender SmartScreen settings and Exploit protection mitigations +- [Family options](wdsc-family-options.md), which includes access to parental controls along with tips and information for keeping kids safe online -The Windows Defender Security Center app uses the [Security Center service](https://technet.microsoft.com/en-us/library/bb457154.aspx#EDAA) to provide the status and information on third-party antivirus and firewall products that are installed on the device. ->[!IMPORTANT] ->Windows Defender AV and the Windows Defender Security Center app use similarly named services for specific purposes. -> ->The Windows Defender Security Center app uses the Windows Defender Security Center Service (*SecurityHealthService* or *Windows Security Health Servce*), which in turn utilizes the Security Center service ([*wscsvc*](https://technet.microsoft.com/en-us/library/bb457154.aspx#EDAA)) to ensure the app provides the most up-to-date information about the protection status on the endpoint, including protection offered by third-party antivirus products, Windows Defender Firewall, and other security protection. -> ->These services do not affect the state of Windows Defender AV. Disabling or modifying these services will not disable Windows Defender AV, and will lead to a lowered protection state on the endpoint, even if you are using a third-party antivirus product. -> ->Windows Defender AV will be [disabled automatically when a third-party antivirus product is installed and kept up to date](../windows-defender-antivirus/windows-defender-antivirus-compatibility.md). -> ->Disabling the Windows Security Center service will not disable Windows Defender AV or [Windows Defender Firewall](https://docs.microsoft.com/en-us/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security). -> [!WARNING] -> If you disable the Security Center service, or configure its associated Group Policy settings to prevent it from starting or running, the Windows Defender Security Center app may display stale or inaccurate information about any antivirus or firewall products you have installed on the device. -> ->It may also prevent Windows Defender AV from enabling itself if you have an old or outdated third-party antivirus, or if you uninstall any third-party antivirus products you may have previously installed. -> ->This will significantly lower the protection of your device and could lead to malware infection. @@ -78,11 +70,31 @@ The Windows Defender Security Center app uses the [Security Center service](http > [!NOTE] -> Settings configured with management tools, such as Group Policy, Microsoft Intune, or System Center Configuration Manager, will generally take precedence over the settings in the Windows Defender Security Center. Review the settings for each feature in its appropriate library. Links for both home user and enterprise or commercial audiences are listed below. +> Settings configured with management tools, such as Group Policy, Microsoft Intune, or System Center Configuration Manager, will generally take precedence over the settings in the Windows Defender Security Center. See the topics for each of the sections for links to configuring the associated features or products. + + ## How the Windows Defender Security Center app works with Windows security features +>[!IMPORTANT] +>Windows Defender AV and the Windows Defender Security Center app use similarly named services for specific purposes. +> +>The Windows Defender Security Center app uses the Windows Defender Security Center Service (*SecurityHealthService* or *Windows Security Health Servce*), which in turn utilizes the Security Center service ([*wscsvc*](https://technet.microsoft.com/en-us/library/bb457154.aspx#EDAA)) to ensure the app provides the most up-to-date information about the protection status on the endpoint, including protection offered by third-party antivirus products, Windows Defender Firewall, third-party firewalls, and other security protection. +> +>These services do not affect the state of Windows Defender AV. Disabling or modifying these services will not disable Windows Defender AV, and will lead to a lowered protection state on the endpoint, even if you are using a third-party antivirus product. +> +>Windows Defender AV will be [disabled automatically when a third-party antivirus product is installed and kept up to date](../windows-defender-antivirus/windows-defender-antivirus-compatibility.md). +> +>Disabling the Windows Security Center service will not disable Windows Defender AV or [Windows Defender Firewall](https://docs.microsoft.com/en-us/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security). + +> [!WARNING] +> If you disable the Security Center service, or configure its associated Group Policy settings to prevent it from starting or running, the Windows Defender Security Center app may display stale or inaccurate information about any antivirus or firewall products you have installed on the device. +> +>It may also prevent Windows Defender AV from enabling itself if you have an old or outdated third-party antivirus, or if you uninstall any third-party antivirus products you may have previously installed. +> +>This will significantly lower the protection of your device and could lead to malware infection. + The Windows Defender Security Center app operates as a separate app or process from each of the individual features, and will display notifications through the Action Center. It acts as a collector or single place to see the status and perform some configuration for each of the features. @@ -92,87 +104,17 @@ Disabling any of the individual features (through Group Policy or other manageme > [!IMPORTANT] > Individually disabling any of the services will not disable the other services or the Windows Defender Security Center app. -For example, using a third-party antivirus will disable Windows Defender Antivirus. However, the Windows Defender Security Center app will still run, show its icon in the taskbar, and display information about the other features, such as Windows Defender SmartScreen and Windows Defender Firewall. - -The presence of the third-party antivirus will be indicated under the **Virus & threat protection** section and third-party firewalls will be shown under the **Firewall & network protection** section in the Windows Defender Security Center app. - -See the [Windows Defender Antivirus compatibility](https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility) topic for more information on how Windows Defender AV works with other antivirus apps, and what options are availble. - - - - -## More information - -See the following links for more information on the features in the Windows Defender Security Center app: -- Windows Defender Antivirus - - IT administrators and IT pros can get configuration guidance from the [Windows Defender Antivirus in the Windows Defender Security Center topic](https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-antivirus/windows-defender-security-center-antivirus) and the [Windows Defender Antivirus documentation library](https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10) - - Home users can learn more at the [Virus & threat protection in Windows Defender Security Center topic at support.microsoft.com](https://support.microsoft.com/en-us/help/4012987/windows-10-virus-threat-protection-windows-defender-security-center) -- Device performance & health - - It administrators and IT pros can [configure the Load and unload device drivers security policy setting](https://docs.microsoft.com/en-us/windows/device-security/security-policy-settings/load-and-unload-device-drivers), and learn how to [deploy drivers during Windows 10 deployment using System Center Configuration Manager](https://docs.microsoft.com/en-us/windows/deployment/deploy-windows-sccm/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager) - - Home users can learn more at the [Track your device and performance health in Windows Defender Security Center topic at support.microsoft.com](https://support.microsoft.com/en-us/help/4012986/windows-defender-track-your-device-performance-health) -- Windows Defender Firewall - - IT administrators and IT pros can get configuration guidance from the [Windows Defender Firewall with Advanced Security documentation library](https://docs.microsoft.com/en-us/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security) - - Home users can learn more at the [Firewall & network protection in Windows Defender Security Center topic at support.microsoft.com](https://support.microsoft.com/en-us/help/4012988/windows-10-firewall-network-protection-windows-defender-security-center) -- Windows Defender SmartScreen - - IT administrators and IT pros can get configuration guidance from the [Windows Defender SmartScreen documentation library](https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview) - - Home users can learn more at the [App & browser control in Windows Defender Security Center topic at support.microsoft.com](https://support.microsoft.com/en-us/help/4013218/windows-10-app-browser-control-in-windows-defender) -- Family options, which includes access to parental controls along with tips and information for keeping kids safe online - - Home users can learn more at the [Help protection your family online in Windows Defender Security Center topic at support.microsoft.com](https://support.microsoft.com/en-us/help/4013209/windows-10-protect-your-family-online-in-windows-defender) - - -## Customize the Windows Defender Security Center app for your organization - -You can add information about your organization in a contact card to the Windows Defender Security Center app. This can include a link to a support site, a phone number for a help desk, and an email address for email-based support. - -![](images/security-center-custom-flyout.png) - -This information will also be shown in some enterprise-specific notifications (including those for [Windows Defender Exploit Guard](/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md), the [Block at first sight feature](/windows/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md), and [potentially unwanted applications](/windows/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md). - -![](images/security-center-custom-notif.png) - - -Users can click on the displayed information to easily initiate a support request: -- Clicking **Call** or the phone number will open Skype to start a call to the displayed number -- Clicking **Email** or the email address will create a new email in the machine's default email app address to the displayed email -- Clicking **Help portal** or the website URL will open the machine's default web browser and go to the displayed address - - -### Use Group Policy to enable and customize contact information - -There are two stages to using the contact card and customized notifications. First, you have to enable the contact card or custom notifications (or both), and then you must specify at least a name for your organization and one piece of contact information. - -This can only be done in Group Policy. - -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. - -3. In the **Group Policy Management Editor** go to **Computer configuration**. - -4. Click **Policies** then **Administrative templates**. - -5. Expand the tree to **Windows components > Windows Defender Security Center > Enterprise Customization**. - -6. You enable the contact card and the customized notifications by configuring two separate Group Policy settings. They will both use the same source of information (explained in Steps 7 and 8), and you can enable both or only one or the other: - - 1. To enable the contact card, open the **Configure customized contact information** setting and set it to **Enabled**. Click **OK**. - - 2. To enable the customized notifications, open the **Configure customized notifications** setting and set it to **Enabled**. Click **OK**. - -7. After you've enabled the contact card or the customized notifications (or both), you must configure the **Specify contact company name** to **Enabled**. Enter your company or organization's name in the field in the **Options** section. Click **OK**. - -8. To ensure the custom notifications or contact card appear, you must also configure at least one of the following settings by opening them, setting them to **Enabled** and adding the contact information in the field under **Options**: - 1. Specify contact email address of Email ID - 2. Specify contact phone number or Skype ID - 3. Specify contact website - -9. Click **OK** after configuring each setting to save your changes. - - ->[!IMPORTANT] ->You must specify the contact company name and at least one contact method - email, phone number, or website URL. If you do not specify the contact name and a contact method the customization will not apply: the contact card will not show, and notifications will not be customized. - - ->[!NOTE] ->The Windows Defender Security Center app is a client interface on Windows 10, version 1703. It is not the Windows Defender Security Center web portal that is used to review and manage [Windows Defender Advanced Threat Protection](https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection). +For example, [using a third-party antivirus will disable Windows Defender Antivirus](https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility). However, the Windows Defender Security Center app will still run, show its icon in the taskbar, and display information about the other features, such as Windows Defender SmartScreen and Windows Defender Firewall. + + + + + + + + + + From ed787b6c0d2f1229eb39ac9cea4d9ba8223fde07 Mon Sep 17 00:00:00 2001 From: Andreas Stenhall Date: Sun, 24 Sep 2017 21:40:07 +0200 Subject: [PATCH 06/49] Missing a backslash in UNC path Missing a backslash in UNC path, it looks OK in the source but only one backslash is displayed in the browser where it should be two backslashes. --- .../import-export-exploit-protection-emet-xml.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md b/windows/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md index c864cb9ed7..bc57272913 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md +++ b/windows/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md @@ -157,7 +157,7 @@ You can use Group Policy to deploy the configuration you've created to multiple 7. In the **Options::** section, enter the location and filename of the Exploit Protection configuration file that you want to use, such as in the following examples: - C:\MitigationSettings\Config.XML - - \\Server\Share\Config.xml + - \\\Server\Share\Config.xml - https://localhost:8080/Config.xml 8. Click **OK** and [Deploy the updated GPO as you normally do](https://msdn.microsoft.com/en-us/library/ee663280(v=vs.85).aspx). From d021b139bf021367d6bafaa848a305edd3a3d290 Mon Sep 17 00:00:00 2001 From: Kaushik Ainapure Date: Wed, 27 Sep 2017 19:38:37 +0530 Subject: [PATCH 07/49] Adding LTSB to Token-based Activation section Our documentation does not currently address LTSB versions. It doesn't have any statement pertaining to LTSB, either way. Added the following text: Token-based Activation option is available for Windows 10 Enterprise LTSB editions (Version 1507 and 1607) --- .../volume-activation/plan-for-volume-activation-client.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/deployment/volume-activation/plan-for-volume-activation-client.md b/windows/deployment/volume-activation/plan-for-volume-activation-client.md index 37335d3504..92299edb2e 100644 --- a/windows/deployment/volume-activation/plan-for-volume-activation-client.md +++ b/windows/deployment/volume-activation/plan-for-volume-activation-client.md @@ -75,6 +75,7 @@ Telephone activation is primarily used in situations where a computer is isolate **Note**   A specialized method, Token-based activation, is available for specific situations when approved customers rely on a public key infrastructure in a completely isolated, and usually high-security, environment. For more information, contact your Microsoft Account Team or your service representative. +Token-based Activation option is available for Windows 10 Enterprise LTSB editions (Version 1507 and 1607). ### Multiple activation key From a472673eac9afa3d5b1a95f0b495b5c869a473d3 Mon Sep 17 00:00:00 2001 From: Don Gill Date: Wed, 27 Sep 2017 09:00:37 -0700 Subject: [PATCH 08/49] Version tweak It should read version 1607 (or later) --- windows/client-management/connect-to-remote-aadj-pc.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/connect-to-remote-aadj-pc.md b/windows/client-management/connect-to-remote-aadj-pc.md index 43db69d30f..d8a901623a 100644 --- a/windows/client-management/connect-to-remote-aadj-pc.md +++ b/windows/client-management/connect-to-remote-aadj-pc.md @@ -23,7 +23,7 @@ From its release, Windows 10 has supported remote connections to PCs that are jo ## Set up -- Both PCs (local and remote) must be running Windows 10, version 1607. Remote connection to an Azure AD-joined PC that is running earlier versions of Windows 10 is not supported. +- Both PCs (local and remote) must be running Windows 10, version 1607 (or later). Remote connection to an Azure AD-joined PC that is running earlier versions of Windows 10 is not supported. - Ensure [Remote Credential Guard](/windows/access-protection/remote-credential-guard), a new feature in Windows 10, version 1607, is turned off on the client PC that you are using to connect to the remote PC. - On the PC that you want to connect to: 1. Open system properties for the remote PC. From 9658240e0174eb060d219b9029d478895faa2087 Mon Sep 17 00:00:00 2001 From: Mike Stephens Date: Thu, 28 Sep 2017 11:29:39 -0700 Subject: [PATCH 09/49] Added videos to FAQ section --- .../hello-identity-verification.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/windows/access-protection/hello-for-business/hello-identity-verification.md b/windows/access-protection/hello-for-business/hello-identity-verification.md index a866155093..27c613c2ea 100644 --- a/windows/access-protection/hello-for-business/hello-identity-verification.md +++ b/windows/access-protection/hello-for-business/hello-identity-verification.md @@ -71,6 +71,24 @@ The table shows the minimum requirements for each deployment. ## Frequently Asked Questions +### What is the user experience for Windows Hello for Business? +The user experience for Windows Hello for Business occurs after user sign once you deploy Windows Hello for Business policy settings to your environment. + +Windows Hello for Business Enrollment including Biometrics +> [!Video https://youtu.be/FJqHPTZTpNM] + +Windows Hello for Business Enrollment PIN only +> [!Video https://youtu.be/etXJsZb8Fso] + +### What happens when my user forgets their PIN? + +If the user can sign-in with a password, they can reset their PIN by clicking the "I forgot my PIN" link in settings. Beginning with the Fall Creators Update, users can reset their PIN above the lock screen by clicking the "I forgot my PIN" link on the PIN credential provider. + +Windows Hello PIN Reset above Lock (Fall Creators Update) +> [!Video https://youtu.be/KcVTq8lTlkI] + +For on-premises deployments, devices must be well connected to their on-premises network (domain controllers and/or certificate authority) to reset their PINs. Hybrid customers can onboard their Azure tenant to use the Windows Hello for Business PIN reset service to reset their PINs without access to their corporate network. + ### Do I need Windows Server 2016 domain controllers? There are many deployment options from which to choose. Some of those options require an adequate number of Windows Server 2016 domain controllers in the site where you have deployed Windows Hello for Business. There are other deployment options that use existing Windows Server 2008 R2 or later domain controllers. Choose the deployment option that best suits your environment From a7acb3bcc58221df6268ab56a25926d08493c85c Mon Sep 17 00:00:00 2001 From: Mike Stephens Date: Thu, 28 Sep 2017 14:19:22 -0700 Subject: [PATCH 10/49] Attempt to fix URL --- .../hello-for-business/hello-identity-verification.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/access-protection/hello-for-business/hello-identity-verification.md b/windows/access-protection/hello-for-business/hello-identity-verification.md index 27c613c2ea..d1acb86c68 100644 --- a/windows/access-protection/hello-for-business/hello-identity-verification.md +++ b/windows/access-protection/hello-for-business/hello-identity-verification.md @@ -75,17 +75,17 @@ The table shows the minimum requirements for each deployment. The user experience for Windows Hello for Business occurs after user sign once you deploy Windows Hello for Business policy settings to your environment. Windows Hello for Business Enrollment including Biometrics -> [!Video https://youtu.be/FJqHPTZTpNM] +> [!VIDEO https://www.youtube.com/watch?v=FJqHPTZTpNM&feature=youtu.be] Windows Hello for Business Enrollment PIN only -> [!Video https://youtu.be/etXJsZb8Fso] +> [!VIDEO https://youtu.be/etXJsZb8Fso] ### What happens when my user forgets their PIN? If the user can sign-in with a password, they can reset their PIN by clicking the "I forgot my PIN" link in settings. Beginning with the Fall Creators Update, users can reset their PIN above the lock screen by clicking the "I forgot my PIN" link on the PIN credential provider. Windows Hello PIN Reset above Lock (Fall Creators Update) -> [!Video https://youtu.be/KcVTq8lTlkI] +> [!VIDEO https://youtu.be/KcVTq8lTlkI] For on-premises deployments, devices must be well connected to their on-premises network (domain controllers and/or certificate authority) to reset their PINs. Hybrid customers can onboard their Azure tenant to use the Windows Hello for Business PIN reset service to reset their PINs without access to their corporate network. From ee97558ae303df587f21748e888847dd31d27e1c Mon Sep 17 00:00:00 2001 From: Mike Stephens Date: Thu, 28 Sep 2017 14:46:38 -0700 Subject: [PATCH 11/49] another attempt to fix video links --- .../hello-for-business/hello-identity-verification.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/access-protection/hello-for-business/hello-identity-verification.md b/windows/access-protection/hello-for-business/hello-identity-verification.md index d1acb86c68..ddccce6045 100644 --- a/windows/access-protection/hello-for-business/hello-identity-verification.md +++ b/windows/access-protection/hello-for-business/hello-identity-verification.md @@ -75,17 +75,17 @@ The table shows the minimum requirements for each deployment. The user experience for Windows Hello for Business occurs after user sign once you deploy Windows Hello for Business policy settings to your environment. Windows Hello for Business Enrollment including Biometrics -> [!VIDEO https://www.youtube.com/watch?v=FJqHPTZTpNM&feature=youtu.be] +> [!VIDEO https://www.youtube.com/embed/FJqHPTZTpNM] Windows Hello for Business Enrollment PIN only -> [!VIDEO https://youtu.be/etXJsZb8Fso] +> [!VIDEO https://www.youtube.com/embed/etXJsZb8Fso] ### What happens when my user forgets their PIN? If the user can sign-in with a password, they can reset their PIN by clicking the "I forgot my PIN" link in settings. Beginning with the Fall Creators Update, users can reset their PIN above the lock screen by clicking the "I forgot my PIN" link on the PIN credential provider. Windows Hello PIN Reset above Lock (Fall Creators Update) -> [!VIDEO https://youtu.be/KcVTq8lTlkI] +> [!VIDEO https://www.youtube.com/embed/KcVTq8lTlkI] For on-premises deployments, devices must be well connected to their on-premises network (domain controllers and/or certificate authority) to reset their PINs. Hybrid customers can onboard their Azure tenant to use the Windows Hello for Business PIN reset service to reset their PINs without access to their corporate network. From 2d26921712b5bf3a476ea83434ffbfb7ef3d234d Mon Sep 17 00:00:00 2001 From: Mike Stephens Date: Thu, 28 Sep 2017 15:21:44 -0700 Subject: [PATCH 12/49] final updates for adding videos --- .../hello-for-business/hello-identity-verification.md | 3 --- 1 file changed, 3 deletions(-) diff --git a/windows/access-protection/hello-for-business/hello-identity-verification.md b/windows/access-protection/hello-for-business/hello-identity-verification.md index ddccce6045..7cb9166f03 100644 --- a/windows/access-protection/hello-for-business/hello-identity-verification.md +++ b/windows/access-protection/hello-for-business/hello-identity-verification.md @@ -74,17 +74,14 @@ The table shows the minimum requirements for each deployment. ### What is the user experience for Windows Hello for Business? The user experience for Windows Hello for Business occurs after user sign once you deploy Windows Hello for Business policy settings to your environment. -Windows Hello for Business Enrollment including Biometrics > [!VIDEO https://www.youtube.com/embed/FJqHPTZTpNM] -Windows Hello for Business Enrollment PIN only > [!VIDEO https://www.youtube.com/embed/etXJsZb8Fso] ### What happens when my user forgets their PIN? If the user can sign-in with a password, they can reset their PIN by clicking the "I forgot my PIN" link in settings. Beginning with the Fall Creators Update, users can reset their PIN above the lock screen by clicking the "I forgot my PIN" link on the PIN credential provider. -Windows Hello PIN Reset above Lock (Fall Creators Update) > [!VIDEO https://www.youtube.com/embed/KcVTq8lTlkI] For on-premises deployments, devices must be well connected to their on-premises network (domain controllers and/or certificate authority) to reset their PINs. Hybrid customers can onboard their Azure tenant to use the Windows Hello for Business PIN reset service to reset their PINs without access to their corporate network. From 01368763d59bba34d359c9eb144a4241898fd2a5 Mon Sep 17 00:00:00 2001 From: Mike Stephens Date: Thu, 28 Sep 2017 15:48:34 -0700 Subject: [PATCH 13/49] adding a line of white space between the enrollment videos --- .../hello-for-business/hello-identity-verification.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/access-protection/hello-for-business/hello-identity-verification.md b/windows/access-protection/hello-for-business/hello-identity-verification.md index 7cb9166f03..4889e47cab 100644 --- a/windows/access-protection/hello-for-business/hello-identity-verification.md +++ b/windows/access-protection/hello-for-business/hello-identity-verification.md @@ -75,7 +75,7 @@ The table shows the minimum requirements for each deployment. The user experience for Windows Hello for Business occurs after user sign once you deploy Windows Hello for Business policy settings to your environment. > [!VIDEO https://www.youtube.com/embed/FJqHPTZTpNM] - +
> [!VIDEO https://www.youtube.com/embed/etXJsZb8Fso] ### What happens when my user forgets their PIN? From dfb9bd25ef14019d3da4719af9ff9364df5af481 Mon Sep 17 00:00:00 2001 From: Mike Stephens Date: Thu, 28 Sep 2017 17:45:19 -0700 Subject: [PATCH 14/49] fix style problem between videos --- .../hello-for-business/hello-identity-verification.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/access-protection/hello-for-business/hello-identity-verification.md b/windows/access-protection/hello-for-business/hello-identity-verification.md index 4889e47cab..1ca171237b 100644 --- a/windows/access-protection/hello-for-business/hello-identity-verification.md +++ b/windows/access-protection/hello-for-business/hello-identity-verification.md @@ -75,7 +75,9 @@ The table shows the minimum requirements for each deployment. The user experience for Windows Hello for Business occurs after user sign once you deploy Windows Hello for Business policy settings to your environment. > [!VIDEO https://www.youtube.com/embed/FJqHPTZTpNM] -
+ +
+ > [!VIDEO https://www.youtube.com/embed/etXJsZb8Fso] ### What happens when my user forgets their PIN? From 4360980e6c8886414cb8ce63519fa3bd31b0348f Mon Sep 17 00:00:00 2001 From: chintanpatel Date: Fri, 29 Sep 2017 10:07:32 -0700 Subject: [PATCH 15/49] Update reqs-wd-app-guard.md --- .../windows-defender-application-guard/reqs-wd-app-guard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md b/windows/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md index 15b33475fa..4fb205b6cc 100644 --- a/windows/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md +++ b/windows/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md @@ -24,7 +24,7 @@ Your environment needs the following hardware to run Application Guard. |--------|-----------| |64-bit CPU|A 64-bit computer is required for hypervisor and virtualization-based security (VBS). For more info about Hyper-V, see [Hyper-V on Windows Server 2016](https://docs.microsoft.com/en-us/windows-server/virtualization/hyper-v/hyper-v-on-windows-server) or [Introduction to Hyper-V on Windows 10](https://docs.microsoft.com/en-us/virtualization/hyper-v-on-windows/about/). For more info about hypervisor, see [Hypervisor Specifications](https://docs.microsoft.com/en-us/virtualization/hyper-v-on-windows/reference/tlfs).| |CPU virtualization extensions|Extended page tables, also called _Second Level Address Translation (SLAT)_

**-AND-**

One of the following virtualization extensions for VBS:

VT-x (Intel)

**-OR-**

AMD-V| -|Hardware memory|8 GB minimum, 16 GB recommended| +|Hardware memory|Microsoft recommends 8GB RAM for optimal performance| |Hard disk|5 GB free space, solid state disk (SSD) recommended| |Input/Output Memory Management Unit (IOMMU) support|Not required, but strongly recommended| From 6e75bf3e2f61378a7a7acc77fd0a10a70db43fd1 Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Fri, 29 Sep 2017 13:42:20 -0700 Subject: [PATCH 16/49] updates to image alts --- .../attack-surface-reduction-exploit-guard.md | 2 +- .../controlled-folders-exploit-guard.md | 2 +- ...tomize-controlled-folders-exploit-guard.md | 8 +++--- .../customize-exploit-protection.md | 28 +++++++++---------- .../enable-attack-surface-reduction.md | 2 +- ...enable-controlled-folders-exploit-guard.md | 4 +-- .../evaluate-attack-surface-reduction.md | 4 +-- .../evaluate-controlled-folder-access.md | 4 +-- .../evaluate-network-protection.md | 2 +- .../event-views-exploit-guard.md | 6 ++-- 10 files changed, 31 insertions(+), 31 deletions(-) diff --git a/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md index ca4ced3a04..320ea854bf 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md @@ -144,7 +144,7 @@ You can review the Windows event log to see events that are created when an Atta 2. On the left panel, under **Actions**, click **Import custom view...** - ![](images/events-import.gif) + ![Animation showing the import custom view on the Event viewer window](images/events-import.gif) 3. Navigate to the Exploit Guard Evaluation Package, and select the file *asr-events.xml*. Alternatively, [copy the XML directly](event-views-exploit-guard.md). diff --git a/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md index 9faffd8366..7f728d947a 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md @@ -75,7 +75,7 @@ You can review the Windows event log to see events that are created when Control 3. On the left panel, under **Actions**, click **Import custom view...** - ![](images/events-import.gif) + ![Animation showing the import custom view on the Event viewer window](images/events-import.gif) 4. Navigate to where you extracted *cfa-events.xml* and select it. Alternatively, [copy the XML directly](event-views-exploit-guard.md). diff --git a/windows/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md index e185c31b19..eecb3be7a2 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md @@ -75,7 +75,7 @@ You can use the Windows Defender Security Center app or Group Policy to add and 4. Click **Add a protected folder** and follow the prompts to add apps. - ![](images/cfa-prot-folders.png) + ![Screenshot of the Virus and threat protection settings button](images/cfa-prot-folders.png) ### Use Group Policy to protect additional folders @@ -107,7 +107,7 @@ You can use the Windows Defender Security Center app or Group Policy to add and Continue to use `Add-MpPreference -ControlledFolderAccessProtectedFolders` to add more folders to the list. Folders added using this cmdlet will appear in the Windows Defender Security Center app. -![](images/cfa-allow-folder-ps.png) +![Screenshot of a PowerShell window with the cmdlet above entered](images/cfa-allow-folder-ps.png) >[!IMPORTANT] @@ -144,7 +144,7 @@ When you add an app, you have to specify the app's location. Only the app in tha 4. Click **Add an allowed app** and follow the prompts to add apps. - ![](images/cfa-allow-app.png) + ![Screenshot of the add an allowed app button](images/cfa-allow-app.png) ### Use Group Policy to whitelist specific apps @@ -178,7 +178,7 @@ When you add an app, you have to specify the app's location. Only the app in tha Continue to use `Add-MpPreference -ControlledFolderAccessAllowedApplications` to add more apps to the list. Apps added using this cmdlet will appear in the Windows Defender Security Center app. -![](images/cfa-allow-app-ps.png) +![Screenshot of a PowerShell window with the above cmdlet entered](images/cfa-allow-app-ps.png) >[!IMPORTANT] diff --git a/windows/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md b/windows/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md index c837adc81b..1f4767560d 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md +++ b/windows/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md @@ -51,25 +51,25 @@ It also describes how to enable or configure the mitigations using Windows Defen All mitigations can be configured for individual apps. Some mitigations can also be applied at the operating system level. -You can set each of the mitigations to on, off, or to their default value as indicated in the table below. Some mitigations have additional options, these are indicated in the description in the table. +You can set each of the mitigations to on, off, or to their default value. Some mitigations have additional options, these are indicated in the description in the table. Default values are always specified in brackets at the **Use default** option for each mitigation. In the following example, the default for Data Execution Prevention is "On". -![](images/ep-default.png) +![Screenshot showing the drop down menu for DEP which shows the default for DEP as On](images/ep-default.png) The **Use default** configuration for each of the mitigation settings indicates our recommendation for a base level of protection for everyday usage for home users. Enterprise deployments should consider the protection required for their individual needs and may need to modify configuration away from the defaults. For the associated PowerShell cmdlets for each mitigation, see the [PowerShell reference table](#cmdlets-table) at the bottom of this topic. -Mitigation | Description | Can be applied to, and default value for system mitigations | Audit mode available +Mitigation | Description | Can be applied to | Audit mode available - | - | - | - -Control flow guard (CFG) | Ensures control flow integrity for indirect calls. Can optionally suppress exports and use strict CFG. | System and app-level (system default: **On**) | [!include[Check mark no](images/svg/check-no.md)] -Data Execution Prevention (DEP) | Prevents code from being run from data-only memory pages such as the heap and stacks. Only configurable for 32-bit (x86) apps, permanently enabled for all other architectures. Can optionally enable ATL thunk emulation. | System and app-level (system default: **On**) | [!include[Check mark no](images/svg/check-no.md)] -Force randomization for images (Mandatory ASLR) | Forcibly relocates images not compiled with /DYNAMICBASE. Can optionally fail loading images that don't have relocation information. | System and app-level (system default: **Off**) | [!include[Check mark no](images/svg/check-no.md)] -Randomize memory allocations (Bottom-Up ASLR) | Randomizes locations for virtual memory allocations including those for system structures heaps, stacks, TEBs, and PEBs. Can optionally use a wider randomization variance for 64-bit processes. | System and app-level (system default: **On**) | [!include[Check mark no](images/svg/check-no.md)] -Validate exception chains (SEHOP) | Ensures the integrity of an exception chain during exception dispatch. Only configurable for 32-bit (x86) applications. | System and app-level (system default: **On**) | [!include[Check mark no](images/svg/check-no.md)] -Validate heap integrity | Terminates a process when heap corruption is detected. | System and app-level (system default: **Off**) | [!include[Check mark no](images/svg/check-no.md)] +Control flow guard (CFG) | Ensures control flow integrity for indirect calls. Can optionally suppress exports and use strict CFG. | System and app-level | [!include[Check mark no](images/svg/check-no.md)] +Data Execution Prevention (DEP) | Prevents code from being run from data-only memory pages such as the heap and stacks. Only configurable for 32-bit (x86) apps, permanently enabled for all other architectures. Can optionally enable ATL thunk emulation. | System and app-level | [!include[Check mark no](images/svg/check-no.md)] +Force randomization for images (Mandatory ASLR) | Forcibly relocates images not compiled with /DYNAMICBASE. Can optionally fail loading images that don't have relocation information. | System and app-level | [!include[Check mark no](images/svg/check-no.md)] +Randomize memory allocations (Bottom-Up ASLR) | Randomizes locations for virtual memory allocations including those for system structures heaps, stacks, TEBs, and PEBs. Can optionally use a wider randomization variance for 64-bit processes. | System and app-level | [!include[Check mark no](images/svg/check-no.md)] +Validate exception chains (SEHOP) | Ensures the integrity of an exception chain during exception dispatch. Only configurable for 32-bit (x86) applications. | System and app-level | [!include[Check mark no](images/svg/check-no.md)] +Validate heap integrity | Terminates a process when heap corruption is detected. | System and app-level | [!include[Check mark no](images/svg/check-no.md)] Arbitrary code guard (ACG) | Prevents the introduction of non-image-backed executable code and prevents code pages from being modified. Can optionally allow thread opt-out and allow remote downgrade (configurable only with PowerShell). | App-level only | [!include[Check mark yes](images/svg/check-yes.md)] Block low integrity images | Prevents the loading of images marked with Low Integrity. | App-level only | [!include[Check mark yes](images/svg/check-yes.md)] Block remote images | Prevents loading of images from remote devices. | App-level only | [!include[Check mark yes](images/svg/check-yes.md)] @@ -127,7 +127,7 @@ Validate stack integrity (StackPivot) | Ensures that the stack has not been redi 2. Click the **App & browser control** tile (or the app icon on the left menu bar) and then the **Exploit protection** label: - ![](images/wdsc-exp-prot.png) + ![App & browser control screen in the Windows Defender Security Center](images/wdsc-exp-prot.png) 3. Under the **System settings** section, find the mitigation you want to configure and select one of the following. Apps that aren't configured individually in the **Program settings** section will use the settings configured here: - **On by default** - The mitigation is *enabled* for apps that don't have this mitigation set in the app-specific **Program settings** section @@ -139,7 +139,7 @@ Validate stack integrity (StackPivot) | Ensures that the stack has not been redi Changing some settings may required a restart, which will be indicated in red text underneath the setting. - ![](images/wdsc-exp-prot-sys-settings.png) + ![Screenshot showing the DEP drop down menu where you can select On, Off, or Default](images/wdsc-exp-prot-sys-settings.png) 4. Repeat this for all the system-level mitigations you want to configure. @@ -154,7 +154,7 @@ Exporting the configuration as an XML file allows you to copy the configuration 2. Click the **App & browser control** tile (or the app icon on the left menu bar) and then the **Exploit protection settings** at the bottom of the screen: - ![](images/wdsc-exp-prot.png) + ![Screenshot showing the Exploit protection label highlighted in the Windows Defender Security Center App & browser settings section](images/wdsc-exp-prot.png) 3. Go to the **Program settings** section and choose the app you want to apply mitigations to: @@ -164,14 +164,14 @@ Exporting the configuration as an XML file allows you to copy the configuration - Use **Add by program name** to have the mitigation applied to any running process with that name. You must specify a file with an extension. You can enter a full path to limit the mitigation to only the app with that name in that location. - Use **Choose exact file path** to use a standard Windows Explorer file picker window to find and select the file you want. - ![](images/wdsc-exp-prot-app-settings.png) + ![Screenshot showing the add file or folder button](images/wdsc-exp-prot-app-settings.png) 4. After selecting the app, you'll see a list of all the mitigations that can be applied. To enable the mitigation, click the check box and then change the slider to **On**. Select any additional options. Choosing **Audit** will apply the mitigation in audit mode only. You will be notified if you need to restart the process or app, or if you need to restart Windows. 5. Repeat this for all the apps and mitigations you want to configure. Click **Apply** when you're done setting up your configuration. - ![](images/wdsc-exp-prot-app-settings-options.png) + ![Screenshot showing some of the options available for an added program](images/wdsc-exp-prot-app-settings-options.png) You can now [export these settings as an XML file](import-export-exploit-protection-emet-xml.md) or return to configure system-level mitigations. diff --git a/windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md b/windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md index 7158a21778..c42e32c42f 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md +++ b/windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md @@ -79,7 +79,7 @@ See the [Attack surface reduction](attack-surface-reduction-exploit-guard.md) to - Disabled = 0 - Audit mode = 2 -![](images/asr-rules-gp.png) +![Group policy setting showing a blank ASR rule ID and value of 1](images/asr-rules-gp.png) diff --git a/windows/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md index 6935d74d73..69153eefb4 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md @@ -60,7 +60,7 @@ For further details on how audit mode works, and when you might want to use it, 3. Set the switch for the feature to **On** - ![](images/cfa-on.png) + ![Screenshot of the CFA feature switched to On](images/cfa-on.png) ### Use Group Policy to enable Controlled folder access @@ -77,7 +77,7 @@ For further details on how audit mode works, and when you might want to use it, - **Disable (Default)** - The Controlled folder access feature will not work. All apps can make changes to files in protected folders. - **Audit Mode** - If a malicious or suspicious app attempts to make a change to a file in a protected folder, the change will be allowed but will be recorded in the Windows event log. This allows you to assess the impact of this feature on your organization. - ![](images/cfa-gp-enable.png) + ![Screenshot of group policy option with Enabled and then Enable selected in the drop down](images/cfa-gp-enable.png) >[!IMPORTANT] >To fully enable the Controlled folder access feature, you must set the Group Policy option to **Enabled** and also select **Enable** in the options drop-down menu. diff --git a/windows/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md b/windows/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md index 832df46955..bd2b01af18 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md +++ b/windows/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md @@ -57,7 +57,7 @@ This tool has a simple user interface that lets you choose a rule, configure it When you run a scenario, you will see what the scenario entails, what the rule is set to, and what actions were taken. -![](images/asr-test-tool.png) +![Screenshot of the Exploit guard demo tool](images/asr-test-tool.png) Each scenario creates a fake or sample file or behavior that the rule would target and, if the rule was enabled, block from running. @@ -99,7 +99,7 @@ Audit | The rule wil fire, but the suspicious behavior will **not** be blocked f Block mode will cause a notification to appear on the user's desktop: -![](images/asr-notif.png) +![Example notification that says Action blocked: Your IT administrator caused Windows Defender Antivirus to block this action. Contact your IT desk.](images/asr-notif.png) You can [modify the notification to display your company name and links](customize-attack-surface-reduction.md#customize-the-notification) for users to obtain more information or contact your IT help desk. diff --git a/windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md b/windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md index c2483edae7..f8829b944e 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md +++ b/windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md @@ -73,11 +73,11 @@ You can enable Controlled folder access, run the tool, and see what the experien 6. You'll be asked to specify a name and location for the file. You can choose anything you wish to test. - ![](images/cfa-filecreator.png) + ![Screenshot of the exploit guard demo tool](images/cfa-filecreator.png) 7. A notification will appear, indicating that the tool was prevented from creating the file, as in the following example: - ![](images/cfa-notif.png) + ![Exampke notification that says Unauthorized changes blocked: Controlled folder access blocked (file name) from making changes to the folder (folder name)](images/cfa-notif.png) ## Review Controlled folder access events in Windows Event Viewer diff --git a/windows/threat-protection/windows-defender-exploit-guard/evaluate-network-protection.md b/windows/threat-protection/windows-defender-exploit-guard/evaluate-network-protection.md index 1d47864477..af1f57f168 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/evaluate-network-protection.md +++ b/windows/threat-protection/windows-defender-exploit-guard/evaluate-network-protection.md @@ -64,7 +64,7 @@ You can also carry out the processes described in this topic in audit or disable You will get a 403 Forbidden response in the browser, and you will see a notification that the network connnection was blocked. -![](images/np-notif.png) +![Example notification that says Connection blocked: Your IT administrator caused Windows Defender Security center to block this network connection. Contact your IT help desk.](images/np-notif.png) ## Review Network protection events in Windows Event Viewer diff --git a/windows/threat-protection/windows-defender-exploit-guard/event-views-exploit-guard.md b/windows/threat-protection/windows-defender-exploit-guard/event-views-exploit-guard.md index 97a86e7fa9..8b068f6f7c 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/event-views-exploit-guard.md +++ b/windows/threat-protection/windows-defender-exploit-guard/event-views-exploit-guard.md @@ -47,7 +47,7 @@ You can also manually navigate to the event area that corresponds to the Windows ### Import an existing XML custom view -1. Download the [Exploit Guard Evaluation Package](https://aka.ms/mp7z2w) and extract the appropraite file to an easily accessible location. The following filenames are each of the custom views: +1. Download the [Exploit Guard Evaluation Package](https://aka.ms/mp7z2w) and extract the appropriate file to an easily accessible location. The following filenames are each of the custom views: - Controlled folder access events custom view: *cfa-events.xml* - Exploit protection events custom view: *ep-events.xml* - Attack surface reduction events custom view: *asr-events.xml* @@ -57,7 +57,7 @@ You can also manually navigate to the event area that corresponds to the Windows 3. On the left panel, under **Actions**, click **Import Custom View...** - ![](images/events-import.gif) + ![Animation highlighting Import custom view on the left of the Even viewer window](images/events-import.gif) 4. Navigate to where you extracted XML file for the custom view you want and select it. @@ -73,7 +73,7 @@ You can also manually navigate to the event area that corresponds to the Windows 3. On the left panel, under **Actions**, click **Create Custom View...** - ![](images/events-create.gif) + ![Animation highlighting the create cusomt view option on the Event viewer window ](images/events-create.gif) 4. Go to the XML tab and click **Edit query manually**. You'll see a warning that you won't be able to edit the query using the **Filter** tab if you use the XML option. Click **Yes**. From 6c5625a168ad910bbe1089468b429a2ce90390b1 Mon Sep 17 00:00:00 2001 From: Mike Stephens Date: Mon, 2 Oct 2017 06:06:08 -0700 Subject: [PATCH 17/49] Fix reported spelling errors --- .../hello-hybrid-cert-whfb-settings-dir-sync.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md b/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md index 51d3af12b8..084999e656 100644 --- a/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md +++ b/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md @@ -25,7 +25,7 @@ ms.date: 09/08/2017 >[!IMPORTANT] >This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. -In hybrid deployments, users register the public portion of their Windows Hello for Business crednetial with Azure. Azure AD Connect syncrhonizes the Windows Hello for Business public key to Active Directory. +In hybrid deployments, users register the public portion of their Windows Hello for Business credential with Azure. Azure AD Connect synchronizes the Windows Hello for Business public key to Active Directory. The key-trust model needs Windows Server 2016 domain controllers, which configures the key registration permissions automatically; however, the certificate-trust model does not and requires you to add the permissions manually. From aec47efc8f977150e457a82e2aa86a756fb3b415 Mon Sep 17 00:00:00 2001 From: Trudy Hakala Date: Mon, 2 Oct 2017 15:15:27 +0000 Subject: [PATCH 18/49] Merged PR 3523: Merge msfb-updates to master change private store ingestion time --- .../app-inventory-management-windows-store-for-business.md | 2 +- store-for-business/distribute-apps-from-your-private-store.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/store-for-business/app-inventory-management-windows-store-for-business.md b/store-for-business/app-inventory-management-windows-store-for-business.md index 6c598f70cc..9eebbb170e 100644 --- a/store-for-business/app-inventory-management-windows-store-for-business.md +++ b/store-for-business/app-inventory-management-windows-store-for-business.md @@ -84,7 +84,7 @@ Once an app is in your private store, people in your org can install the app on 3. Use **Refine results** to search for online-licensed apps under **License type**. 4. From the list of online-licensed apps, click the ellipses for the app you want, and then choose **Add to private store**. -The value under **Private store** for the app will change to pending. It will take approximately twelve hours before the app is available in the private store. +The value under **Private store** for the app will change to pending. It will take approximately thirty-six hours before the app is available in the private store. Employees can claim apps that admins added to the private store by doing the following. **To claim an app from the private store** diff --git a/store-for-business/distribute-apps-from-your-private-store.md b/store-for-business/distribute-apps-from-your-private-store.md index 29e97b30bb..73c7ff9a4c 100644 --- a/store-for-business/distribute-apps-from-your-private-store.md +++ b/store-for-business/distribute-apps-from-your-private-store.md @@ -44,7 +44,7 @@ Microsoft Store adds the app to **Apps & software**. Click **Manage**, **Apps & -The value under **Private store** for the app will change to pending. It will take approximately twelve hours before the app is available in the private store. +The value under **Private store** for the app will change to pending. It will take approximately thirty-six hours before the app is available in the private store. Employees can claim apps that admins added to the private store by doing the following. From 758b6f8ae3f116dc21f6ea5acdf212b494d70006 Mon Sep 17 00:00:00 2001 From: Trudy Hakala Date: Mon, 2 Oct 2017 16:58:08 +0000 Subject: [PATCH 19/49] Merged PR 3524: Merge msfb-12357182 to master Settings updates and request app feature. --- ...acquire-apps-windows-store-for-business.md | 22 +++++++++++++------ ...age-settings-windows-store-for-business.md | 3 +-- ...gs-reference-windows-store-for-business.md | 16 ++++++++------ ...ows-store-for-business-account-settings.md | 18 +++++++-------- 4 files changed, 34 insertions(+), 25 deletions(-) diff --git a/store-for-business/acquire-apps-windows-store-for-business.md b/store-for-business/acquire-apps-windows-store-for-business.md index aa700ada3e..42ad5a517d 100644 --- a/store-for-business/acquire-apps-windows-store-for-business.md +++ b/store-for-business/acquire-apps-windows-store-for-business.md @@ -6,6 +6,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store author: TrudyHa +ms.date: 10/01/2017 ms.localizationpriority: high --- @@ -30,18 +31,17 @@ There are a couple of things we need to know when you pay for apps. You can add - Legal business address - Payment option (credit card) - ## Acquire apps **To acquire an app** -1. Log in to http://businessstore.microsoft.com -2. Click Shop, or use Search to find an app. +1. Sign in to http://businessstore.microsoft.com +2. Click **Shop**, or use Search to find an app. 3. Click the app you want to purchase. 4. On the product description page, choose your license type - either online or offline. -5. Free apps will be added to **Inventory** or **Apps & software**. For apps with a price, you can set the quantity you want to buy. Type the quantity and click **Next**. -6. If you don’t have a payment method saved in **Account Information** or **Payments & billing**, we will prompt you for one. -7. Add your credit card or debit card info, and click **Next**. Your card info is saved as a payment option on **Account information** or **Payments & billing**. +5. Free apps will be added to **Products & services**. For apps with a price, you can set the quantity you want to buy. Type the quantity and click **Next**. +6. If you don’t have a payment method saved in **Billing - Payment methods**, we will prompt you for one. +7. Add your credit card or debit card info, and click **Next**. Your card info is saved as a payment option on **Billing - Payment methods**. -You’ll also need to have your business address saved on **Account information** or **Payments & billing**. The address is used to generate tax rates. For more information on taxes for apps, see [organization tax information](https://technet.microsoft.com/itpro/windows/manage/update-windows-store-for-business-account-settings#organization-tax-information). +You’ll also need to have your business address saved on ****Billing - Account profile***. The address is used to generate tax rates. For more information on taxes for apps, see [organization tax information](https://technet.microsoft.com/itpro/windows/manage/update-windows-store-for-business-account-settings#organization-tax-information). Microsoft Store adds the app to your inventory. From **Inventory** or **Apps & software**, you can: - Distribute the app: add to private store, or assign licenses @@ -51,3 +51,11 @@ Microsoft Store adds the app to your inventory. From **Inventory** or **Apps & s For info on distributing apps, see [Distribute apps to your employees from the Microsoft Store for Business](distribute-apps-to-your-employees-windows-store-for-business.md). For info on offline-licensed apps, see [Distribute offline apps](distribute-offline-apps.md). + +## Request apps +People in your org can request additional licenses for apps that are in your organization's private store. When **Allow app requests** is turned on, people in your org can respond to a notification about app license availability. Admins for your tenant will receive an email with the request, and can decide about making the purchase. + +**To manage Allow app requests** +1. Sign in to http://businessstore.microsoft.com +2. Click **Manage**, click **Settings**, and then click **Distribute**. +3. Under **Private store** turn on, or turn off **Allow app requests**. diff --git a/store-for-business/manage-settings-windows-store-for-business.md b/store-for-business/manage-settings-windows-store-for-business.md index f9592cd92e..e30487958f 100644 --- a/store-for-business/manage-settings-windows-store-for-business.md +++ b/store-for-business/manage-settings-windows-store-for-business.md @@ -12,7 +12,6 @@ ms.localizationpriority: high # Manage settings for Microsoft Store for Business and Education - **Applies to** - Windows 10 @@ -24,7 +23,7 @@ You can add users and groups, as well as update some of the settings associated | Topic | Description | | ----- | ----------- | -| [Update Microsoft Store for Business and Education account settings](update-windows-store-for-business-account-settings.md) | The **Account information** page in Microsoft Store for Business shows information about your organization that you can update, including: organization information, payment options, and offline licensing settings. | +| [Update Microsoft Store for Business and Education account settings](update-windows-store-for-business-account-settings.md) | **Billing - Account profile** in Microsoft Store for Business shows information about your organization that you can update. Payment options can be managed on **Billing - Payment methods**, and offline license settings can be managed on **Settings - Shop**. | | [Manage user accounts in Microsoft Store for Business and Education](manage-users-and-groups-windows-store-for-business.md) | Microsoft Store for Business manages permissions with a set of roles. Currently, you can [assign these roles to individuals in your organization](roles-and-permissions-windows-store-for-business.md), but not to groups. | diff --git a/store-for-business/settings-reference-windows-store-for-business.md b/store-for-business/settings-reference-windows-store-for-business.md index 09fbf09a41..6d5922b831 100644 --- a/store-for-business/settings-reference-windows-store-for-business.md +++ b/store-for-business/settings-reference-windows-store-for-business.md @@ -22,13 +22,15 @@ The Microsoft Store for Business and Education has a group of settings that admi | Setting | Description | Location under **Manage** | | ------- | ----------- | ------------------------------ | -| Account information and payment options | Manage organization and payment option information. For more information, see [Manage settings for the Microsoft Store for Business and Education](manage-settings-windows-store-for-business.md).| **Payments & billing** | -| Private store | Update the name for your private store. The new name will be displayed on a tab in the Store. For more information, see [Manage private store settings](manage-private-store-settings.md). | **Store settings** | -| Offline licensing | Configure whether or not to make offline-licensed apps available in the Microsoft Store for Business and Education. For more information, see [Distribute offline apps](distribute-offline-apps.md). | **Store settings** (Private store tab) | -| Management tools | Management tools that are synced with Azure AD are listed on this page. You can choose one to use for managing app updates and distribution. For more information, see [Configure MDM provider](configure-mdm-provider-windows-store-for-business.md). | **Store settings** | -| Device Guard signing | Use the Device Guard signing portal to add unsigned apps to a code integrity policy, or to sign code integrity policies. For more information, see [Device Guard signing portal](device-guard-signing-portal.md). | **Store settings** | -| Permissions | Manage permissions for your employees. For more information, see [Roles and permissions in the Microsoft Store for Business and Education](roles-and-permissions-windows-store-for-business.md). | **Permissions** | -| Line-of-business (LOB) publishers | Invite devs to become LOB publishers for your organization. Existing LOB publishers are listed on the page, and you can deactivate or invite them again. For more information, see [Work with line-of-business apps](working-with-line-of-business-apps.md). | **Permissions** | +| Account information | Manage organization information. For more information, see [Manage settings for the Microsoft Store for Business and Education](update-windows-store-for-business-account-settings.md).| **Billing - Account profile** | +| Payment options | Manage payment options. For more information, see [Manage settings for the Microsoft Store for Business and Education](update-windows-store-for-business-account-settings.md#payment-options).| **Billing - Payment methods** | +| Private store | Update the name for your private store. The new name will be displayed on a tab in the Store. For more information, see [Manage private store settings](manage-private-store-settings.md). | **Settings - Distribute** | +| Offline licensing | Configure whether or not to make offline-licensed apps available in the Microsoft Store for Business and Education. For more information, see [Distribute offline apps](distribute-offline-apps.md). | **Settings - Shop** | +| App request | Configure whether or not people in your organization can request apps for admins to purchase. For more information, see [Distribute offline apps](acquire-apps-windows-store-for-business.md). | **Settings - Distribute** | +| Management tools | Management tools that are synced with Azure AD are listed on this page. You can choose one to use for managing app updates and distribution. For more information, see [Configure MDM provider](configure-mdm-provider-windows-store-for-business.md). | **Settings - Distribute** | +| Device Guard signing | Use the Device Guard signing portal to add unsigned apps to a code integrity policy, or to sign code integrity policies. For more information, see [Device Guard signing portal](device-guard-signing-portal.md). | **Settings - Devices** | +| Permissions | Manage permissions for your employees. For more information, see [Roles and permissions in the Microsoft Store for Business and Education](roles-and-permissions-windows-store-for-business.md). | **Permissions - Roles** and **Permissions - Blocked basic purchasers** | +| Line-of-business (LOB) publishers | Invite devs to become LOB publishers for your organization. Existing LOB publishers are listed on the page, and you can deactivate or invite them again. For more information, see [Work with line-of-business apps](working-with-line-of-business-apps.md). | **Permissions - Line-of-business apps** | diff --git a/store-for-business/update-windows-store-for-business-account-settings.md b/store-for-business/update-windows-store-for-business-account-settings.md index f88eec0840..951212afbd 100644 --- a/store-for-business/update-windows-store-for-business-account-settings.md +++ b/store-for-business/update-windows-store-for-business-account-settings.md @@ -32,7 +32,7 @@ We need an email address in case we need to contact you about your Microsoft Sto **To update Organization information** 1. Sign in to the [Store for Business](http://businessstore.microsoft.com) or [Store for Education](https://educationstore.microsoft.com) -2. Click **Manage**, click **Payments & billing**, and then click **Edit**. +2. Click **Manage**, click **Billing**, **Account profile**, and then click **Edit**. ## Organization tax information Taxes for Microsoft Store for Business purchases are determined by your business address. Businesses in these countries can provide their VAT number or local equivalent: @@ -87,7 +87,7 @@ If you qualify for tax-exempt status in your market, start a service request to **To start a service request** 1. Sign in to the [Store for Business](http://businessstore.microsoft.com). -2. Click **Support**, and then under **Store or account support** click **Start a service request**. +2. Click **Manage**, click **Support**, and then under **Store settings & configuration** click **Create technical support ticket**. You’ll need this documentation: @@ -124,8 +124,8 @@ You can purchase apps from Microsoft Store for Business using your credit card. **To add a new payment option** 1. Sign in to the [Store for Business](http://businessstore.microsoft.com) or [Store for Education](https://educationstore.microsoft.com). -2. Click **Manage**, and then click **Payments & billing**. -3. Under **Payment options**, click **Show my payment options**, and then select the type of credit card that you want to add. +2. Click **Manage**, click **Billing**, and then click **Payments methods**. +3. Click **Add a payment options**, and then select the type of credit card that you want to add. 4. Add information to any required fields, and then click **Next**. Once you click Next, the information you provided will be validated with a test authorization transaction and, if validated, the payment option will be added to your list of available payment options. Otherwise, you will be prompted for additional information or notified if there are any problems. @@ -136,10 +136,10 @@ Once you click Next, the information you provided will be validated with a tes **To update a payment option** 1. Sign in to the [Store for Business](http://businessstore.microsoft.com) or [Store for Education](https://educationstore.microsoft.com). -2. Click **Manage**, and then click **Payments & billng**. -3. Under **Payment options** > **Show my payment options**, select the payment option that you want to update, and then click **Update**. +2. Click **Manage**, click **Billing**, and then click **Payments methods**. +3. Select the payment option that you want to update, and then click **Update**. 4. Enter any updated information in the appropriate fields, and then click **Next**. -Once you click **Next**, the information you provided will be validated with a test authorization transaction and, if validated, the payment option will be added to your list of available payment options. Otherwise,you will be prompted for additional information or notified if there are any problems. +Once you click **Next**, the information you provided will be validated with a test authorization transaction and, if validated, the payment option will be added to your list of available payment options. Otherwise, you will be prompted for additional information or notified if there are any problems. > [!NOTE] > Certain actions, like updating or adding a payment option, require temporary “test authorization” transactions to validate the payment option. These may appear on your statement as $0.00 authorizations or as small pending transactions. These transactions are temporary and should not impact your account unless you make several changes in a short period of time, or have a low balance. @@ -153,8 +153,8 @@ Admins can decide whether or not offline licenses are shown for apps in Microsof **To set offline license visibility** 1. Sign in to the [Store for Business](http://businessstore.microsoft.com) or [Store for Education](https://educationstore.microsoft.com). -2. Click **Manage**, and then click **Payments & billing**. -3. Under **Offline licensing**, click **Show offline licensed apps to people shopping in the store** to show availability for both online and offline licenses. +2. Click **Manage**, and then click **Settings - Shop**. +3. Under **Shopping experience** turn on or turn off **Show offline apps**,to show availability for offline-licensed apps. You have the following distribution options for offline-licensed apps: - Include the app in a provisioning package, and then use it as part of imaging a device. From 4eb941a4aa99e02d9e3640b6bf1e8f748cb76975 Mon Sep 17 00:00:00 2001 From: Nicholas Brower Date: Mon, 2 Oct 2017 19:13:23 +0000 Subject: [PATCH 20/49] Merged PR 3528: Adding scope info, linked policy lists, and additional formatting. --- .../policy-configuration-service-provider.md | 22 +- .../mdm/policy-csp-abovelock.md | 46 +- .../mdm/policy-csp-accounts.md | 59 +- .../mdm/policy-csp-activexcontrols.md | 20 +- .../mdm/policy-csp-applicationdefaults.md | 20 +- .../mdm/policy-csp-applicationmanagement.md | 150 +- .../mdm/policy-csp-appvirtualization.md | 371 +- .../mdm/policy-csp-attachmentmanager.md | 46 +- .../mdm/policy-csp-authentication.md | 59 +- .../mdm/policy-csp-autoplay.md | 49 +- .../mdm/policy-csp-bitlocker.md | 20 +- .../mdm/policy-csp-bluetooth.md | 72 +- .../mdm/policy-csp-browser.md | 511 ++- .../mdm/policy-csp-camera.md | 20 +- .../mdm/policy-csp-cellular.md | 20 +- .../mdm/policy-csp-connectivity.md | 176 +- .../mdm/policy-csp-credentialproviders.md | 46 +- .../mdm/policy-csp-credentialsui.md | 34 +- .../mdm/policy-csp-cryptography.md | 33 +- .../mdm/policy-csp-dataprotection.md | 33 +- .../mdm/policy-csp-datausage.md | 33 +- .../mdm/policy-csp-defender.md | 462 ++- .../mdm/policy-csp-deliveryoptimization.md | 215 +- .../mdm/policy-csp-desktop.md | 20 +- .../mdm/policy-csp-deviceguard.md | 46 +- .../mdm/policy-csp-deviceinstallation.md | 33 +- .../mdm/policy-csp-devicelock.md | 215 +- .../mdm/policy-csp-display.md | 33 +- .../mdm/policy-csp-education.md | 46 +- .../mdm/policy-csp-enterprisecloudprint.md | 85 +- .../mdm/policy-csp-errorreporting.md | 72 +- .../mdm/policy-csp-eventlogservice.md | 59 +- .../mdm/policy-csp-experience.md | 254 +- .../mdm/policy-csp-exploitguard.md | 20 +- .../client-management/mdm/policy-csp-games.md | 21 +- .../mdm/policy-csp-handwriting.md | 25 +- .../mdm/policy-csp-internetexplorer.md | 3518 ++++++++++++++++- .../mdm/policy-csp-kerberos.md | 72 +- .../mdm/policy-csp-licensing.md | 33 +- ...policy-csp-localpoliciessecurityoptions.md | 310 +- .../mdm/policy-csp-location.md | 20 +- .../mdm/policy-csp-lockdown.md | 20 +- .../client-management/mdm/policy-csp-maps.md | 33 +- .../mdm/policy-csp-messaging.md | 46 +- .../mdm/policy-csp-networkisolation.md | 111 +- .../mdm/policy-csp-notifications.md | 20 +- .../client-management/mdm/policy-csp-power.md | 124 +- .../mdm/policy-csp-printers.md | 46 +- .../mdm/policy-csp-privacy.md | 1008 ++++- .../mdm/policy-csp-remoteassistance.md | 59 +- .../mdm/policy-csp-remotedesktopservices.md | 85 +- .../mdm/policy-csp-remotemanagement.md | 202 +- .../mdm/policy-csp-remoteprocedurecall.md | 33 +- .../mdm/policy-csp-remoteshell.md | 98 +- .../mdm/policy-csp-search.md | 137 +- .../mdm/policy-csp-security.md | 128 +- .../mdm/policy-csp-settings.md | 176 +- .../mdm/policy-csp-smartscreen.md | 46 +- .../mdm/policy-csp-speech.md | 20 +- .../client-management/mdm/policy-csp-start.md | 372 +- .../mdm/policy-csp-storage.md | 20 +- .../mdm/policy-csp-system.md | 178 +- .../mdm/policy-csp-textinput.md | 167 +- .../mdm/policy-csp-timelanguagesettings.md | 20 +- .../mdm/policy-csp-update.md | 594 ++- .../client-management/mdm/policy-csp-wifi.md | 89 +- ...olicy-csp-windowsdefendersecuritycenter.md | 189 +- .../mdm/policy-csp-windowsinkworkspace.md | 33 +- .../mdm/policy-csp-windowslogon.md | 46 +- .../mdm/policy-csp-wirelessdisplay.md | 85 +- 70 files changed, 11441 insertions(+), 143 deletions(-) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 121d77fdb7..f0b176f45a 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -7,7 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 08/25/2017 +ms.date: 09/29/2017 --- # Policy CSP @@ -22,6 +22,26 @@ The Policy configuration service provider has the following sub-categories: - Policy/Config/*AreaName* – Handles the policy configuration request from the server. - Policy/Result/*AreaName* – Provides a read-only path to policies enforced on the device. + + +> [!Important] +> Policy scope is the level at which a policy can be configured. Some policies can only be configured at the device level, meaning the policy will take effect independent of who is logged into the device. Other policies can be configured at the user level, meaning the policy will only take effect for that user. +> +> The allowed scope of a specific policy is represented below its table of supported Windows editions. To configure a policy under a specific scope (user vs. device), please use the following paths: +> +> User scope: +> - **./User/Vendor/MSFT/Policy/Config/_AreaName/PolicyName_** to configure the policy. +> - **./User/Vendor/MSFT/Policy/Result/_AreaName/PolicyName_** to get the result. +> +> Device scope: +> - **./Device/Vendor/MSFT/Policy/Config/_AreaName/PolicyName_** to configure the policy. +> - **./Device/Vendor/MSFT/Policy/Result/_AreaName/PolicyName_** to get the result. +> +> For device wide configuration the **_Device/_** portion may be omitted from the path, deeming the following paths respectively equivalent: +> +> - **./Vendor/MSFT/Policy/Config/_AreaName/PolicyName_** to configure the policy. +> - **./Vendor/MSFT/Policy/Result/_AreaName/PolicyName_** to get the result. + The following diagram shows the Policy configuration service provider in tree format as used by both Open Mobile Alliance Device Management (OMA DM) and OMA Client Provisioning. ![policy csp diagram](images/provisioning-csp-policy.png) diff --git a/windows/client-management/mdm/policy-csp-abovelock.md b/windows/client-management/mdm/policy-csp-abovelock.md index 2268695665..64f921aac1 100644 --- a/windows/client-management/mdm/policy-csp-abovelock.md +++ b/windows/client-management/mdm/policy-csp-abovelock.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 08/30/2017 +ms.date: 09/29/2017 --- # Policy CSP - AboveLock @@ -14,11 +14,24 @@ ms.date: 08/30/2017 > [!WARNING] > Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -
+ ## AboveLock policies +
+
+ AboveLock/AllowActionCenterNotifications +
+
+ AboveLock/AllowCortanaAboveLock +
+
+ AboveLock/AllowToasts +
+
+ +
**AboveLock/AllowActionCenterNotifications** @@ -45,6 +58,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. @@ -60,6 +82,7 @@ ms.date: 08/30/2017 +
**AboveLock/AllowCortanaAboveLock** @@ -86,6 +109,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ +

Added in Windows 10, version 1607. Specifies whether or not the user can interact with Cortana using speech while the system is locked. If you enable or don’t configure this setting, the user can interact with Cortana using speech while the system is locked. If you disable this setting, the system will need to be unlocked for the user to interact with Cortana using speech. @@ -96,6 +128,7 @@ ms.date: 08/30/2017 +

**AboveLock/AllowToasts** @@ -122,6 +155,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ +

Specifies whether to allow toast notifications above the device lock screen. diff --git a/windows/client-management/mdm/policy-csp-accounts.md b/windows/client-management/mdm/policy-csp-accounts.md index f2e678427b..cbec351d99 100644 --- a/windows/client-management/mdm/policy-csp-accounts.md +++ b/windows/client-management/mdm/policy-csp-accounts.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 08/30/2017 +ms.date: 09/29/2017 --- # Policy CSP - Accounts @@ -14,11 +14,27 @@ ms.date: 08/30/2017 > [!WARNING] > Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -

+ ## Accounts policies +
+
+ Accounts/AllowAddingNonMicrosoftAccountsManually +
+
+ Accounts/AllowMicrosoftAccountConnection +
+
+ Accounts/AllowMicrosoftAccountSignInAssistant +
+
+ Accounts/DomainNamesForEmailSync +
+
+ +
**Accounts/AllowAddingNonMicrosoftAccountsManually** @@ -45,6 +61,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ +

Specifies whether user is allowed to add non-MSA email accounts. @@ -60,6 +85,7 @@ ms.date: 08/30/2017 +

**Accounts/AllowMicrosoftAccountConnection** @@ -86,6 +112,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ +

Specifies whether the user is allowed to use an MSA account for non-email related connection authentication and services. @@ -98,6 +133,7 @@ ms.date: 08/30/2017 +

**Accounts/AllowMicrosoftAccountSignInAssistant** @@ -124,6 +160,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ +

Added in Windows 10, version 1703. Allows IT Admins the ability to disable the "Microsoft Account Sign-In Assistant" (wlidsvc) NT service. @@ -134,6 +179,7 @@ ms.date: 08/30/2017 +

**Accounts/DomainNamesForEmailSync** @@ -160,6 +206,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ +

Specifies a list of the domains that are allowed to sync email on the device. diff --git a/windows/client-management/mdm/policy-csp-activexcontrols.md b/windows/client-management/mdm/policy-csp-activexcontrols.md index 755aeb5a2e..d01ca2a458 100644 --- a/windows/client-management/mdm/policy-csp-activexcontrols.md +++ b/windows/client-management/mdm/policy-csp-activexcontrols.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 08/30/2017 +ms.date: 09/29/2017 --- # Policy CSP - ActiveXControls @@ -14,11 +14,18 @@ ms.date: 08/30/2017 > [!WARNING] > Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -

+ ## ActiveXControls policies +
+
+ ActiveXControls/ApprovedInstallationSites +
+
+ +
**ActiveXControls/ApprovedInstallationSites** @@ -45,6 +52,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + This policy setting determines which ActiveX installation sites standard users in your organization can use to install ActiveX controls on their computers. When this setting is enabled, the administrator can create a list of approved Activex Install sites specified by host URL. diff --git a/windows/client-management/mdm/policy-csp-applicationdefaults.md b/windows/client-management/mdm/policy-csp-applicationdefaults.md index 838ad9fbc8..4e71e25975 100644 --- a/windows/client-management/mdm/policy-csp-applicationdefaults.md +++ b/windows/client-management/mdm/policy-csp-applicationdefaults.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 08/30/2017 +ms.date: 09/29/2017 --- # Policy CSP - ApplicationDefaults @@ -14,11 +14,18 @@ ms.date: 08/30/2017 > [!WARNING] > Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -
+ ## ApplicationDefaults policies +
+
+ ApplicationDefaults/DefaultAssociationsConfiguration +
+
+ +
**ApplicationDefaults/DefaultAssociationsConfiguration** @@ -45,6 +52,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ +

Added in Windows 10, version 1703. This policy allows an administrator to set default file type and protocol associations. When set, default associations will be applied on sign-in to the PC. The association file can be created using the DISM tool (dism /online /export-defaultappassociations:appassoc.xml), and then needs to be base64 encoded before being added to SyncML. diff --git a/windows/client-management/mdm/policy-csp-applicationmanagement.md b/windows/client-management/mdm/policy-csp-applicationmanagement.md index db13ecc123..7953580ab4 100644 --- a/windows/client-management/mdm/policy-csp-applicationmanagement.md +++ b/windows/client-management/mdm/policy-csp-applicationmanagement.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 08/30/2017 +ms.date: 09/29/2017 --- # Policy CSP - ApplicationManagement @@ -14,11 +14,48 @@ ms.date: 08/30/2017 > [!WARNING] > Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -

+ ## ApplicationManagement policies +
+
+ ApplicationManagement/AllowAllTrustedApps +
+
+ ApplicationManagement/AllowAppStoreAutoUpdate +
+
+ ApplicationManagement/AllowDeveloperUnlock +
+
+ ApplicationManagement/AllowGameDVR +
+
+ ApplicationManagement/AllowSharedUserAppData +
+
+ ApplicationManagement/AllowStore +
+
+ ApplicationManagement/ApplicationRestrictions +
+
+ ApplicationManagement/DisableStoreOriginatedApps +
+
+ ApplicationManagement/RequirePrivateStoreOnly +
+
+ ApplicationManagement/RestrictAppDataToSystemVolume +
+
+ ApplicationManagement/RestrictAppToSystemVolume +
+
+ +
**ApplicationManagement/AllowAllTrustedApps** @@ -45,6 +82,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ +

Specifies whether non Windows Store apps are allowed. @@ -58,6 +104,7 @@ ms.date: 08/30/2017 +

**ApplicationManagement/AllowAppStoreAutoUpdate** @@ -84,6 +131,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ +

Specifies whether automatic update of apps from Windows Store are allowed. @@ -96,6 +152,7 @@ ms.date: 08/30/2017 +

**ApplicationManagement/AllowDeveloperUnlock** @@ -122,6 +179,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ +

Specifies whether developer unlock is allowed. @@ -135,6 +201,7 @@ ms.date: 08/30/2017 +

**ApplicationManagement/AllowGameDVR** @@ -161,6 +228,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > The policy is only enforced in Windows 10 for desktop. @@ -176,6 +252,7 @@ ms.date: 08/30/2017 +
**ApplicationManagement/AllowSharedUserAppData** @@ -202,6 +279,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ +

Specifies whether multiple users of the same app can share data. @@ -214,6 +300,7 @@ ms.date: 08/30/2017 +

**ApplicationManagement/AllowStore** @@ -240,6 +327,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ +

Specifies whether app store is allowed at the device. @@ -252,6 +348,7 @@ ms.date: 08/30/2017 +

**ApplicationManagement/ApplicationRestrictions** @@ -278,6 +375,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. For desktop devices, use the [AppLocker CSP](applocker-csp.md) instead. @@ -305,6 +411,7 @@ ms.date: 08/30/2017 +
**ApplicationManagement/DisableStoreOriginatedApps** @@ -331,6 +438,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ +

Added in Windows 10, version 1607. Boolean value that disables the launch of all apps from Windows Store that came pre-installed or were downloaded. @@ -341,6 +457,7 @@ ms.date: 08/30/2017 +

**ApplicationManagement/RequirePrivateStoreOnly** @@ -367,6 +484,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ +

Allows disabling of the retail catalog and only enables the Private store. @@ -388,6 +514,7 @@ ms.date: 08/30/2017 +

**ApplicationManagement/RestrictAppDataToSystemVolume** @@ -414,6 +541,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ +

Specifies whether application data is restricted to the system drive. @@ -426,6 +562,7 @@ ms.date: 08/30/2017 +

**ApplicationManagement/RestrictAppToSystemVolume** @@ -452,6 +589,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ +

Specifies whether the installation of applications is restricted to the system drive. diff --git a/windows/client-management/mdm/policy-csp-appvirtualization.md b/windows/client-management/mdm/policy-csp-appvirtualization.md index e44fda0b34..512cbecf60 100644 --- a/windows/client-management/mdm/policy-csp-appvirtualization.md +++ b/windows/client-management/mdm/policy-csp-appvirtualization.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 08/30/2017 +ms.date: 09/29/2017 --- # Policy CSP - AppVirtualization @@ -14,11 +14,99 @@ ms.date: 08/30/2017 > [!WARNING] > Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -

+ ## AppVirtualization policies +
+
+ AppVirtualization/AllowAppVClient +
+
+ AppVirtualization/AllowDynamicVirtualization +
+
+ AppVirtualization/AllowPackageCleanup +
+
+ AppVirtualization/AllowPackageScripts +
+
+ AppVirtualization/AllowPublishingRefreshUX +
+
+ AppVirtualization/AllowReportingServer +
+
+ AppVirtualization/AllowRoamingFileExclusions +
+
+ AppVirtualization/AllowRoamingRegistryExclusions +
+
+ AppVirtualization/AllowStreamingAutoload +
+
+ AppVirtualization/ClientCoexistenceAllowMigrationmode +
+
+ AppVirtualization/IntegrationAllowRootGlobal +
+
+ AppVirtualization/IntegrationAllowRootUser +
+
+ AppVirtualization/PublishingAllowServer1 +
+
+ AppVirtualization/PublishingAllowServer2 +
+
+ AppVirtualization/PublishingAllowServer3 +
+
+ AppVirtualization/PublishingAllowServer4 +
+
+ AppVirtualization/PublishingAllowServer5 +
+
+ AppVirtualization/StreamingAllowCertificateFilterForClient_SSL +
+
+ AppVirtualization/StreamingAllowHighCostLaunch +
+
+ AppVirtualization/StreamingAllowLocationProvider +
+
+ AppVirtualization/StreamingAllowPackageInstallationRoot +
+
+ AppVirtualization/StreamingAllowPackageSourceRoot +
+
+ AppVirtualization/StreamingAllowReestablishmentInterval +
+
+ AppVirtualization/StreamingAllowReestablishmentRetries +
+
+ AppVirtualization/StreamingSharedContentStoreMode +
+
+ AppVirtualization/StreamingSupportBranchCache +
+
+ AppVirtualization/StreamingVerifyCertificateRevocationList +
+
+ AppVirtualization/VirtualComponentsAllowList +
+
+ +
**AppVirtualization/AllowAppVClient** @@ -45,6 +133,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + This policy setting allows you to enable or disable Microsoft Application Virtualization (App-V) feature. Reboot is needed for disable to take effect. @@ -65,6 +162,7 @@ ADMX Info: +
**AppVirtualization/AllowDynamicVirtualization** @@ -91,6 +189,15 @@ ADMX Info: + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + Enables Dynamic Virtualization of supported shell extensions, browser helper objects, and ActiveX controls. @@ -111,6 +218,7 @@ ADMX Info: +
**AppVirtualization/AllowPackageCleanup** @@ -137,6 +245,15 @@ ADMX Info: + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + Enables automatic cleanup of appv packages that were added after Windows10 anniversary release. @@ -157,6 +274,7 @@ ADMX Info: +
**AppVirtualization/AllowPackageScripts** @@ -183,6 +301,15 @@ ADMX Info: + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + Enables scripts defined in the package manifest of configuration files that should run. @@ -203,6 +330,7 @@ ADMX Info: +
**AppVirtualization/AllowPublishingRefreshUX** @@ -229,6 +357,15 @@ ADMX Info: + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + Enables a UX to display to the user when a publishing refresh is performed on the client. @@ -249,6 +386,7 @@ ADMX Info: +
**AppVirtualization/AllowReportingServer** @@ -275,6 +413,15 @@ ADMX Info: + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + Reporting Server URL: Displays the URL of reporting server. @@ -305,6 +452,7 @@ ADMX Info: +
**AppVirtualization/AllowRoamingFileExclusions** @@ -331,6 +479,15 @@ ADMX Info: + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + Specifies the file paths relative to %userprofile% that do not roam with a user's profile. Example usage: /FILEEXCLUSIONLIST='desktop;my pictures'. @@ -351,6 +508,7 @@ ADMX Info: +
**AppVirtualization/AllowRoamingRegistryExclusions** @@ -377,6 +535,15 @@ ADMX Info: + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + Specifies the registry paths that do not roam with a user profile. Example usage: /REGISTRYEXCLUSIONLIST=software\classes;software\clients. @@ -397,6 +564,7 @@ ADMX Info: +
**AppVirtualization/AllowStreamingAutoload** @@ -423,6 +591,15 @@ ADMX Info: + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + Specifies how new packages should be loaded automatically by App-V on a specific computer. @@ -443,6 +620,7 @@ ADMX Info: +
**AppVirtualization/ClientCoexistenceAllowMigrationmode** @@ -469,6 +647,15 @@ ADMX Info: + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + Migration mode allows the App-V client to modify shortcuts and FTA's for packages created using a previous version of App-V. @@ -489,6 +676,7 @@ ADMX Info: +
**AppVirtualization/IntegrationAllowRootGlobal** @@ -515,6 +703,15 @@ ADMX Info: + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + Specifies the location where symbolic links are created to the current version of a per-user published package. Shortcuts, file type associations, etc. are created pointing to this path. If empty, symbolic links are not used during publishing. Example: %localappdata%\Microsoft\AppV\Client\Integration. @@ -535,6 +732,7 @@ ADMX Info: +
**AppVirtualization/IntegrationAllowRootUser** @@ -561,6 +759,15 @@ ADMX Info: + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + Specifies the location where symbolic links are created to the current version of a globally published package. Shortcuts, file type associations, etc. are created pointing to this path. If empty, symbolic links are not used during publishing. Example: %allusersprofile%\Microsoft\AppV\Client\Integration. @@ -581,6 +788,7 @@ ADMX Info: +
**AppVirtualization/PublishingAllowServer1** @@ -607,6 +815,15 @@ ADMX Info: + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + Publishing Server Display Name: Displays the name of publishing server. @@ -645,6 +862,7 @@ ADMX Info: +
**AppVirtualization/PublishingAllowServer2** @@ -671,6 +889,15 @@ ADMX Info: + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + Publishing Server Display Name: Displays the name of publishing server. @@ -709,6 +936,7 @@ ADMX Info: +
**AppVirtualization/PublishingAllowServer3** @@ -735,6 +963,15 @@ ADMX Info: + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + Publishing Server Display Name: Displays the name of publishing server. @@ -773,6 +1010,7 @@ ADMX Info: +
**AppVirtualization/PublishingAllowServer4** @@ -799,6 +1037,15 @@ ADMX Info: + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + Publishing Server Display Name: Displays the name of publishing server. @@ -837,6 +1084,7 @@ ADMX Info: +
**AppVirtualization/PublishingAllowServer5** @@ -863,6 +1111,15 @@ ADMX Info: + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + Publishing Server Display Name: Displays the name of publishing server. @@ -901,6 +1158,7 @@ ADMX Info: +
**AppVirtualization/StreamingAllowCertificateFilterForClient_SSL** @@ -927,6 +1185,15 @@ ADMX Info: + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + Specifies the path to a valid certificate in the certificate store. @@ -947,6 +1214,7 @@ ADMX Info: +
**AppVirtualization/StreamingAllowHighCostLaunch** @@ -973,6 +1241,15 @@ ADMX Info: + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + This setting controls whether virtualized applications are launched on Windows 8 machines connected via a metered network connection (e.g. 4G). @@ -993,6 +1270,7 @@ ADMX Info: +
**AppVirtualization/StreamingAllowLocationProvider** @@ -1019,6 +1297,15 @@ ADMX Info: + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + Specifies the CLSID for a compatible implementation of the IAppvPackageLocationProvider interface. @@ -1039,6 +1326,7 @@ ADMX Info: +
**AppVirtualization/StreamingAllowPackageInstallationRoot** @@ -1065,6 +1353,15 @@ ADMX Info: + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + Specifies directory where all new applications and updates will be installed. @@ -1085,6 +1382,7 @@ ADMX Info: +
**AppVirtualization/StreamingAllowPackageSourceRoot** @@ -1111,6 +1409,15 @@ ADMX Info: + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + Overrides source location for downloading package content. @@ -1131,6 +1438,7 @@ ADMX Info: +
**AppVirtualization/StreamingAllowReestablishmentInterval** @@ -1157,6 +1465,15 @@ ADMX Info: + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + Specifies the number of seconds between attempts to reestablish a dropped session. @@ -1177,6 +1494,7 @@ ADMX Info: +
**AppVirtualization/StreamingAllowReestablishmentRetries** @@ -1203,6 +1521,15 @@ ADMX Info: + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + Specifies the number of times to retry a dropped session. @@ -1223,6 +1550,7 @@ ADMX Info: +
**AppVirtualization/StreamingSharedContentStoreMode** @@ -1249,6 +1577,15 @@ ADMX Info: + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + Specifies that streamed package contents will be not be saved to the local hard disk. @@ -1269,6 +1606,7 @@ ADMX Info: +
**AppVirtualization/StreamingSupportBranchCache** @@ -1295,6 +1633,15 @@ ADMX Info: + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + If enabled, the App-V client will support BrancheCache compatible HTTP streaming. If BranchCache support is not desired, this should be disabled. The client can then apply HTTP optimizations which are incompatible with BranchCache @@ -1315,6 +1662,7 @@ ADMX Info: +
**AppVirtualization/StreamingVerifyCertificateRevocationList** @@ -1341,6 +1689,15 @@ ADMX Info: + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + Verifies Server certificate revocation status before streaming using HTTPS. @@ -1361,6 +1718,7 @@ ADMX Info: +
**AppVirtualization/VirtualComponentsAllowList** @@ -1387,6 +1745,15 @@ ADMX Info: + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + Specifies a list of process paths (may contain wildcards) which are candidates for using virtual components (shell extensions, browser helper objects, etc). Only processes whose full path matches one of these items can use virtual components. diff --git a/windows/client-management/mdm/policy-csp-attachmentmanager.md b/windows/client-management/mdm/policy-csp-attachmentmanager.md index 202f7f324a..19b60c53f6 100644 --- a/windows/client-management/mdm/policy-csp-attachmentmanager.md +++ b/windows/client-management/mdm/policy-csp-attachmentmanager.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 08/30/2017 +ms.date: 09/29/2017 --- # Policy CSP - AttachmentManager @@ -14,11 +14,24 @@ ms.date: 08/30/2017 > [!WARNING] > Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -
+ ## AttachmentManager policies +
+
+ AttachmentManager/DoNotPreserveZoneInformation +
+
+ AttachmentManager/HideZoneInfoMechanism +
+
+ AttachmentManager/NotifyAntivirusPrograms +
+
+ +
**AttachmentManager/DoNotPreserveZoneInformation** @@ -45,6 +58,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + This policy setting allows you to manage whether Windows marks file attachments with information about their zone of origin (such as restricted, Internet, intranet, local). This requires NTFS in order to function correctly, and will fail without notice on FAT32. By not preserving the zone information, Windows cannot make proper risk assessments. @@ -71,6 +93,7 @@ ADMX Info: +
**AttachmentManager/HideZoneInfoMechanism** @@ -97,6 +120,15 @@ ADMX Info: + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + This policy setting allows you to manage whether users can manually remove the zone information from saved file attachments by clicking the Unblock button in the file's property sheet or by using a check box in the security warning dialog. Removing the zone information allows users to open potentially dangerous file attachments that Windows has blocked users from opening. @@ -123,6 +155,7 @@ ADMX Info: +
**AttachmentManager/NotifyAntivirusPrograms** @@ -149,6 +182,15 @@ ADMX Info: + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + This policy setting allows you to manage the behavior for notifying registered antivirus programs. If multiple programs are registered, they will all be notified. If the registered antivirus program already performs on-access checks or scans files as they arrive on the computer's email server, additional calls would be redundant. diff --git a/windows/client-management/mdm/policy-csp-authentication.md b/windows/client-management/mdm/policy-csp-authentication.md index 3c483fb097..d33bbd648c 100644 --- a/windows/client-management/mdm/policy-csp-authentication.md +++ b/windows/client-management/mdm/policy-csp-authentication.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 09/06/2017 +ms.date: 09/29/2017 --- # Policy CSP - Authentication @@ -14,11 +14,27 @@ ms.date: 09/06/2017 > [!WARNING] > Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -
+ ## Authentication policies +
+
+ Authentication/AllowAadPasswordReset +
+
+ Authentication/AllowEAPCertSSO +
+
+ Authentication/AllowFastReconnect +
+
+ Authentication/AllowSecondaryAuthenticationDevice +
+
+ +
**Authentication/AllowAadPasswordReset** @@ -45,6 +61,15 @@ ms.date: 09/06/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ +

Added in Windows 10, version 1709. Specifies whether password reset is enabled for Azure Active Directory accounts. This policy allows the Azure AD tenant administrators to enable self service password reset feature on the windows logon screen.  @@ -55,6 +80,7 @@ ms.date: 09/06/2017 +

**Authentication/AllowEAPCertSSO** @@ -81,6 +107,15 @@ ms.date: 09/06/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ +

Allows an EAP cert-based authentication for a single sign on (SSO) to access internal resources. @@ -98,6 +133,7 @@ ms.date: 09/06/2017 +

**Authentication/AllowFastReconnect** @@ -124,6 +160,15 @@ ms.date: 09/06/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ +

Allows EAP Fast Reconnect from being attempted for EAP Method TLS. @@ -136,6 +181,7 @@ ms.date: 09/06/2017 +

**Authentication/AllowSecondaryAuthenticationDevice** @@ -162,6 +208,15 @@ ms.date: 09/06/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ +

Added in Windows 10, version 1607. Allows secondary authentication devices to work with Windows. diff --git a/windows/client-management/mdm/policy-csp-autoplay.md b/windows/client-management/mdm/policy-csp-autoplay.md index daac26b55d..f63666cdc6 100644 --- a/windows/client-management/mdm/policy-csp-autoplay.md +++ b/windows/client-management/mdm/policy-csp-autoplay.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 08/30/2017 +ms.date: 09/29/2017 --- # Policy CSP - Autoplay @@ -14,11 +14,24 @@ ms.date: 08/30/2017 > [!WARNING] > Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -

+ ## Autoplay policies +
+
+ Autoplay/DisallowAutoplayForNonVolumeDevices +
+
+ Autoplay/SetDefaultAutoRunBehavior +
+
+ Autoplay/TurnOffAutoPlay +
+
+ +
**Autoplay/DisallowAutoplayForNonVolumeDevices** @@ -45,6 +58,16 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
+ + This policy setting disallows AutoPlay for MTP devices like cameras or phones. @@ -69,6 +92,7 @@ ADMX Info: +
**Autoplay/SetDefaultAutoRunBehavior** @@ -95,6 +119,16 @@ ADMX Info: + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
+ + This policy setting sets the default behavior for Autorun commands. @@ -128,6 +162,7 @@ ADMX Info: +
**Autoplay/TurnOffAutoPlay** @@ -154,6 +189,16 @@ ADMX Info: + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
+ + This policy setting allows you to turn off the Autoplay feature. diff --git a/windows/client-management/mdm/policy-csp-bitlocker.md b/windows/client-management/mdm/policy-csp-bitlocker.md index 1220f63607..3d4c5bac81 100644 --- a/windows/client-management/mdm/policy-csp-bitlocker.md +++ b/windows/client-management/mdm/policy-csp-bitlocker.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 08/30/2017 +ms.date: 09/29/2017 --- # Policy CSP - Bitlocker @@ -14,11 +14,18 @@ ms.date: 08/30/2017 > [!WARNING] > Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -
+ ## Bitlocker policies +
+
+ Bitlocker/EncryptionMethod +
+
+ +
**Bitlocker/EncryptionMethod** @@ -45,6 +52,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ +

Specifies the BitLocker Drive Encryption method and cipher strength. diff --git a/windows/client-management/mdm/policy-csp-bluetooth.md b/windows/client-management/mdm/policy-csp-bluetooth.md index 7bd2ea4992..d874f9ffa2 100644 --- a/windows/client-management/mdm/policy-csp-bluetooth.md +++ b/windows/client-management/mdm/policy-csp-bluetooth.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 08/30/2017 +ms.date: 09/29/2017 --- # Policy CSP - Bluetooth @@ -14,11 +14,30 @@ ms.date: 08/30/2017 > [!WARNING] > Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -

+ ## Bluetooth policies +
+
+ Bluetooth/AllowAdvertising +
+
+ Bluetooth/AllowDiscoverableMode +
+
+ Bluetooth/AllowPrepairing +
+
+ Bluetooth/LocalDeviceName +
+
+ Bluetooth/ServicesAllowedList +
+
+ +
**Bluetooth/AllowAdvertising** @@ -45,6 +64,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ +

Specifies whether the device can send out Bluetooth advertisements. @@ -59,6 +87,7 @@ ms.date: 08/30/2017 +

**Bluetooth/AllowDiscoverableMode** @@ -85,6 +114,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ +

Specifies whether other Bluetooth-enabled devices can discover the device. @@ -99,6 +137,7 @@ ms.date: 08/30/2017 +

**Bluetooth/AllowPrepairing** @@ -125,6 +164,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ +

Specifies whether to allow specific bundled Bluetooth peripherals to automatically pair with the host device. @@ -135,6 +183,7 @@ ms.date: 08/30/2017 +

**Bluetooth/LocalDeviceName** @@ -161,6 +210,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ +

Sets the local Bluetooth device name. @@ -170,6 +228,7 @@ ms.date: 08/30/2017 +

**Bluetooth/ServicesAllowedList** @@ -196,6 +255,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ +

Set a list of allowable services and profiles. String hex formatted array of Bluetooth service UUIDs in canonical format, delimited by semicolons. For example, {782AFCFC-7CAA-436C-8BF0-78CD0FFBD4AF}. diff --git a/windows/client-management/mdm/policy-csp-browser.md b/windows/client-management/mdm/policy-csp-browser.md index 82c992e8eb..2c7f399858 100644 --- a/windows/client-management/mdm/policy-csp-browser.md +++ b/windows/client-management/mdm/policy-csp-browser.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 08/30/2017 +ms.date: 09/29/2017 --- # Policy CSP - Browser @@ -14,11 +14,123 @@ ms.date: 08/30/2017 > [!WARNING] > Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -

+ ## Browser policies +
+
+ Browser/AllowAddressBarDropdown +
+
+ Browser/AllowAutofill +
+
+ Browser/AllowBrowser +
+
+ Browser/AllowCookies +
+
+ Browser/AllowDeveloperTools +
+
+ Browser/AllowDoNotTrack +
+
+ Browser/AllowExtensions +
+
+ Browser/AllowFlash +
+
+ Browser/AllowFlashClickToRun +
+
+ Browser/AllowInPrivate +
+
+ Browser/AllowMicrosoftCompatibilityList +
+
+ Browser/AllowPasswordManager +
+
+ Browser/AllowPopups +
+
+ Browser/AllowSearchEngineCustomization +
+
+ Browser/AllowSearchSuggestionsinAddressBar +
+
+ Browser/AllowSmartScreen +
+
+ Browser/AlwaysEnableBooksLibrary +
+
+ Browser/ClearBrowsingDataOnExit +
+
+ Browser/ConfigureAdditionalSearchEngines +
+
+ Browser/DisableLockdownOfStartPages +
+
+ Browser/EnterpriseModeSiteList +
+
+ Browser/EnterpriseSiteListServiceUrl +
+
+ Browser/FirstRunURL +
+
+ Browser/HomePages +
+
+ Browser/LockdownFavorites +
+
+ Browser/PreventAccessToAboutFlagsInMicrosoftEdge +
+
+ Browser/PreventFirstRunPage +
+
+ Browser/PreventLiveTileDataCollection +
+
+ Browser/PreventSmartScreenPromptOverride +
+
+ Browser/PreventSmartScreenPromptOverrideForFiles +
+
+ Browser/PreventUsingLocalHostIPAddressForWebRTC +
+
+ Browser/ProvisionFavorites +
+
+ Browser/SendIntranetTraffictoInternetExplorer +
+
+ Browser/SetDefaultSearchEngine +
+
+ Browser/ShowMessageWhenOpeningSitesInInternetExplorer +
+
+ Browser/SyncFavoritesBetweenIEAndMicrosoftEdge +
+
+ +
**Browser/AllowAddressBarDropdown** @@ -45,6 +157,16 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
+ +

Added in Windows 10, version 1703. Specifies whether to allow the address bar drop-down functionality in Microsoft Edge. If you want to minimize network connections from Microsoft Edge to Microsoft services, we recommend disabling this functionality.  @@ -60,6 +182,7 @@ ms.date: 08/30/2017 +

**Browser/AllowAutofill** @@ -86,6 +209,16 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
+ +

Specifies whether autofill on websites is allowed. @@ -105,6 +238,7 @@ ms.date: 08/30/2017 +

**Browser/AllowBrowser** @@ -131,6 +265,16 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. For desktop devices, use the [AppLocker CSP](applocker-csp.md) instead. @@ -149,6 +293,7 @@ ms.date: 08/30/2017 +
**Browser/AllowCookies** @@ -175,6 +320,16 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
+ +

Specifies whether cookies are allowed. @@ -194,6 +349,7 @@ ms.date: 08/30/2017 +

**Browser/AllowDeveloperTools** @@ -220,6 +376,16 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile. @@ -236,6 +402,7 @@ ms.date: 08/30/2017 +
**Browser/AllowDoNotTrack** @@ -262,6 +429,16 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
+ +

Specifies whether Do Not Track headers are allowed. @@ -281,6 +458,7 @@ ms.date: 08/30/2017 +

**Browser/AllowExtensions** @@ -307,6 +485,16 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
+ +

Added in Windows 10, version 1607. Specifies whether Microsoft Edge extensions are allowed. @@ -317,6 +505,7 @@ ms.date: 08/30/2017 +

**Browser/AllowFlash** @@ -343,6 +532,16 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
+ +

Added in Windows 10. Specifies whether Adobe Flash can run in Microsoft Edge. @@ -353,6 +552,7 @@ ms.date: 08/30/2017 +

**Browser/AllowFlashClickToRun** @@ -379,6 +579,16 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
+ +

Added in Windows 10, version 1703. Specifies whether users must take an action, such as clicking the content or a Click-to-Run button, before seeing content in Adobe Flash. @@ -389,6 +599,7 @@ ms.date: 08/30/2017 +

**Browser/AllowInPrivate** @@ -415,6 +626,16 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
+ +

Specifies whether InPrivate browsing is allowed on corporate networks. @@ -427,6 +648,7 @@ ms.date: 08/30/2017 +

**Browser/AllowMicrosoftCompatibilityList** @@ -453,6 +675,16 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
+ +

Added in Windows 10, version 1703. Specifies whether to use the Microsoft compatibility list in Microsoft Edge. The Microsoft compatibility list is a Microsoft-provided list that enables sites with known compatibility issues to display properly. By default, the Microsoft compatibility list is enabled and can be viewed by visiting "about:compat". @@ -468,6 +700,7 @@ By default, the Microsoft compatibility list is enabled and can be viewed by vis +

**Browser/AllowPasswordManager** @@ -494,6 +727,16 @@ By default, the Microsoft compatibility list is enabled and can be viewed by vis + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
+ +

Specifies whether saving and managing passwords locally on the device is allowed. @@ -513,6 +756,7 @@ By default, the Microsoft compatibility list is enabled and can be viewed by vis +

**Browser/AllowPopups** @@ -539,6 +783,16 @@ By default, the Microsoft compatibility list is enabled and can be viewed by vis + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
+ +

Specifies whether pop-up blocker is allowed or enabled. @@ -558,6 +812,7 @@ By default, the Microsoft compatibility list is enabled and can be viewed by vis +

**Browser/AllowSearchEngineCustomization** @@ -584,6 +839,16 @@ By default, the Microsoft compatibility list is enabled and can be viewed by vis + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
+ +

Added in Windows 10, version 1703. Allows search engine customization for MDM-enrolled devices. Users can change their default search engine.     @@ -598,6 +863,7 @@ By default, the Microsoft compatibility list is enabled and can be viewed by vis +

**Browser/AllowSearchSuggestionsinAddressBar** @@ -624,6 +890,16 @@ By default, the Microsoft compatibility list is enabled and can be viewed by vis + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
+ +

Specifies whether search suggestions are allowed in the address bar. @@ -636,6 +912,7 @@ By default, the Microsoft compatibility list is enabled and can be viewed by vis +

**Browser/AllowSmartScreen** @@ -662,6 +939,16 @@ By default, the Microsoft compatibility list is enabled and can be viewed by vis + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
+ +

Specifies whether Windows Defender SmartScreen is allowed. @@ -681,9 +968,20 @@ By default, the Microsoft compatibility list is enabled and can be viewed by vis +

**Browser/AlwaysEnableBooksLibrary** + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
+ +

@@ -691,6 +989,7 @@ By default, the Microsoft compatibility list is enabled and can be viewed by vis +

**Browser/ClearBrowsingDataOnExit** @@ -717,6 +1016,16 @@ By default, the Microsoft compatibility list is enabled and can be viewed by vis + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
+ +

Added in Windows 10, version 1703. Specifies whether to clear browsing data on exiting Microsoft Edge. @@ -735,6 +1044,7 @@ By default, the Microsoft compatibility list is enabled and can be viewed by vis +

**Browser/ConfigureAdditionalSearchEngines** @@ -761,6 +1071,16 @@ By default, the Microsoft compatibility list is enabled and can be viewed by vis + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
+ +

Added in Windows 10, version 1703. Allows you to add up to 5 additional search engines for MDM-enrolled devices.    @@ -781,6 +1101,7 @@ Employees cannot remove these search engines, but they can set any one as the de +

**Browser/DisableLockdownOfStartPages** @@ -807,6 +1128,16 @@ Employees cannot remove these search engines, but they can set any one as the de + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
+ +

Added in Windows 10, version 1703. Boolean value that specifies whether the lockdown on the Start pages is disabled. This policy works with the Browser/HomePages policy, which locks down the Start pages that the users cannot modify. You can use the DisableLockdownOfStartPages policy to allow users to modify the Start pages when the Browser/HomePages policy is in effect.     @@ -825,6 +1156,7 @@ Employees cannot remove these search engines, but they can set any one as the de +

**Browser/EnterpriseModeSiteList** @@ -851,6 +1183,16 @@ Employees cannot remove these search engines, but they can set any one as the de + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile. @@ -865,6 +1207,7 @@ Employees cannot remove these search engines, but they can set any one as the de +
**Browser/EnterpriseSiteListServiceUrl** @@ -891,12 +1234,23 @@ Employees cannot remove these search engines, but they can set any one as the de + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
+ + > [!IMPORTANT] > This policy (introduced in Windows 10, version 1507) was deprecated in Windows 10, version 1511 by [Browser/EnterpriseModeSiteList](#browser-enterprisemodesitelist). +
**Browser/FirstRunURL** @@ -923,6 +1277,16 @@ Employees cannot remove these search engines, but they can set any one as the de + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. @@ -936,6 +1300,7 @@ Employees cannot remove these search engines, but they can set any one as the de +
**Browser/HomePages** @@ -962,6 +1327,16 @@ Employees cannot remove these search engines, but they can set any one as the de + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
+ + > [!NOTE] > This policy is only available for Windows 10 for desktop and not supported in Windows 10 Mobile. @@ -977,6 +1352,7 @@ Employees cannot remove these search engines, but they can set any one as the de +
**Browser/LockdownFavorites** @@ -1003,6 +1379,16 @@ Employees cannot remove these search engines, but they can set any one as the de + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
+ +

Added in Windows 10, version 1709. This policy setting lets you decide whether employees can add, import, sort, or edit the Favorites list on Microsoft Edge. @@ -1022,6 +1408,7 @@ Employees cannot remove these search engines, but they can set any one as the de +

**Browser/PreventAccessToAboutFlagsInMicrosoftEdge** @@ -1048,6 +1435,16 @@ Employees cannot remove these search engines, but they can set any one as the de + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
+ +

Specifies whether users can access the about:flags page, which is used to change developer settings and to enable experimental features. @@ -1058,6 +1455,7 @@ Employees cannot remove these search engines, but they can set any one as the de +

**Browser/PreventFirstRunPage** @@ -1084,6 +1482,16 @@ Employees cannot remove these search engines, but they can set any one as the de + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
+ +

Added in Windows 10, version 1703. Specifies whether to enable or disable the First Run webpage. On the first explicit user-launch of Microsoft Edge, a First Run webpage hosted on Microsoft.com opens automatically via a FWLINK. This policy allows enterprises (such as those enrolled in a zero-emissions configuration) to prevent this page from opening. @@ -1096,6 +1504,7 @@ Employees cannot remove these search engines, but they can set any one as the de +

**Browser/PreventLiveTileDataCollection** @@ -1122,6 +1531,16 @@ Employees cannot remove these search engines, but they can set any one as the de + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
+ +

Added in Windows 10, version 1703. Specifies whether Microsoft can collect information to create a Live Tile when pinning a site to Start from Microsoft Edge. @@ -1134,6 +1553,7 @@ Employees cannot remove these search engines, but they can set any one as the de +

**Browser/PreventSmartScreenPromptOverride** @@ -1160,6 +1580,16 @@ Employees cannot remove these search engines, but they can set any one as the de + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
+ +

Specifies whether users can override the Windows Defender SmartScreen Filter warnings about potentially malicious websites. @@ -1172,6 +1602,7 @@ Employees cannot remove these search engines, but they can set any one as the de +

**Browser/PreventSmartScreenPromptOverrideForFiles** @@ -1198,6 +1629,16 @@ Employees cannot remove these search engines, but they can set any one as the de + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
+ +

Specifies whether users can override the Windows Defender SmartScreen Filter warnings about downloading unverified files. Turning this setting on stops users from ignoring the Windows Defender SmartScreen Filter warnings and blocks them from downloading unverified files. Turning this setting off, or not configuring it, lets users ignore the Windows Defender SmartScreen Filter warnings about unverified files and lets them continue the download process. @@ -1208,6 +1649,7 @@ Employees cannot remove these search engines, but they can set any one as the de +

**Browser/PreventUsingLocalHostIPAddressForWebRTC** @@ -1234,6 +1676,16 @@ Employees cannot remove these search engines, but they can set any one as the de + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile. @@ -1248,6 +1700,7 @@ Employees cannot remove these search engines, but they can set any one as the de +
**Browser/ProvisionFavorites** @@ -1274,6 +1727,16 @@ Employees cannot remove these search engines, but they can set any one as the de + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
+ +

Added in Windows 10, version 1709. This policy setting allows you to configure a default set of favorites, which will appear for employees. Employees cannot modify, sort, move, export or delete these provisioned favorites. Specify the URL which points to the file that has all the data for provisioning favorites (in html format). You can export a set of favorites from Edge and use that html file for provisioning user machines.   @@ -1292,6 +1755,7 @@ Employees cannot remove these search engines, but they can set any one as the de +

**Browser/SendIntranetTraffictoInternetExplorer** @@ -1318,6 +1782,16 @@ Employees cannot remove these search engines, but they can set any one as the de + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile. @@ -1334,6 +1808,7 @@ Employees cannot remove these search engines, but they can set any one as the de +
**Browser/SetDefaultSearchEngine** @@ -1360,6 +1835,16 @@ Employees cannot remove these search engines, but they can set any one as the de + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
+ +

Added in Windows 10, version 1703. Allows you configure the default search engine for your employees. By default, your employees can change the default search engine at any time. If you want to prevent your employees from changing the default search engine that you set, you can do so by configuring the AllowSearchEngineCustomization policy. @@ -1379,6 +1864,7 @@ Employees cannot remove these search engines, but they can set any one as the de +

**Browser/ShowMessageWhenOpeningSitesInInternetExplorer** @@ -1405,6 +1891,16 @@ Employees cannot remove these search engines, but they can set any one as the de + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile. @@ -1421,6 +1917,7 @@ Employees cannot remove these search engines, but they can set any one as the de +
**Browser/SyncFavoritesBetweenIEAndMicrosoftEdge** @@ -1447,6 +1944,16 @@ Employees cannot remove these search engines, but they can set any one as the de + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
+ +

Added in Windows 10, version 1703. Specifies whether favorites are kept in sync between Internet Explorer and Microsoft Edge. Changes to favorites in one browser are reflected in the other, including: additions, deletions, modifications, and ordering. diff --git a/windows/client-management/mdm/policy-csp-camera.md b/windows/client-management/mdm/policy-csp-camera.md index ca7b98ecc5..ce33fa4faa 100644 --- a/windows/client-management/mdm/policy-csp-camera.md +++ b/windows/client-management/mdm/policy-csp-camera.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 08/30/2017 +ms.date: 09/29/2017 --- # Policy CSP - Camera @@ -14,11 +14,18 @@ ms.date: 08/30/2017 > [!WARNING] > Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -

+ ## Camera policies +
+
+ Camera/AllowCamera +
+
+ +
**Camera/AllowCamera** @@ -45,6 +52,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ +

Disables or enables the camera. diff --git a/windows/client-management/mdm/policy-csp-cellular.md b/windows/client-management/mdm/policy-csp-cellular.md index b1c206e118..183748ec41 100644 --- a/windows/client-management/mdm/policy-csp-cellular.md +++ b/windows/client-management/mdm/policy-csp-cellular.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 08/30/2017 +ms.date: 09/29/2017 --- # Policy CSP - Cellular @@ -14,11 +14,18 @@ ms.date: 08/30/2017 > [!WARNING] > Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -

+ ## Cellular policies +
+
+ Cellular/ShowAppCellularAccessUI +
+
+ +
**Cellular/ShowAppCellularAccessUI** @@ -45,6 +52,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!TIP] diff --git a/windows/client-management/mdm/policy-csp-connectivity.md b/windows/client-management/mdm/policy-csp-connectivity.md index 5ffa503ab6..415ebf1eac 100644 --- a/windows/client-management/mdm/policy-csp-connectivity.md +++ b/windows/client-management/mdm/policy-csp-connectivity.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 08/30/2017 +ms.date: 09/29/2017 --- # Policy CSP - Connectivity @@ -14,11 +14,54 @@ ms.date: 08/30/2017 > [!WARNING] > Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -
+ ## Connectivity policies +
+
+ Connectivity/AllowBluetooth +
+
+ Connectivity/AllowCellularData +
+
+ Connectivity/AllowCellularDataRoaming +
+
+ Connectivity/AllowConnectedDevices +
+
+ Connectivity/AllowNFC +
+
+ Connectivity/AllowUSBConnection +
+
+ Connectivity/AllowVPNOverCellular +
+
+ Connectivity/AllowVPNRoamingOverCellular +
+
+ Connectivity/DiablePrintingOverHTTP +
+
+ Connectivity/DisableDownloadingOfPrintDriversOverHTTP +
+
+ Connectivity/DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards +
+
+ Connectivity/HardenedUNCPaths +
+
+ Connectivity/ProhibitInstallationAndConfigurationOfNetworkBridge +
+
+ +
**Connectivity/AllowBluetooth** @@ -45,6 +88,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ +

Allows the user to enable Bluetooth or restrict access. @@ -64,6 +116,7 @@ ms.date: 08/30/2017 +

**Connectivity/AllowCellularData** @@ -90,6 +143,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ +

Allows the cellular data channel on the device. Device reboot is not required to enforce the policy. @@ -101,6 +163,7 @@ ms.date: 08/30/2017 +

**Connectivity/AllowCellularDataRoaming** @@ -127,6 +190,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ +

Allows or disallows cellular data roaming on the device. Device reboot is not required to enforce the policy. @@ -148,6 +220,7 @@ ms.date: 08/30/2017 +

**Connectivity/AllowConnectedDevices** @@ -174,6 +247,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy requires reboot to take effect. @@ -187,6 +269,7 @@ ms.date: 08/30/2017 +
**Connectivity/AllowNFC** @@ -213,6 +296,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. @@ -229,6 +321,7 @@ ms.date: 08/30/2017 +
**Connectivity/AllowUSBConnection** @@ -255,6 +348,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. @@ -273,6 +375,7 @@ ms.date: 08/30/2017 +
**Connectivity/AllowVPNOverCellular** @@ -299,6 +402,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ +

Specifies what type of underlying connections VPN is allowed to use. @@ -311,6 +423,7 @@ ms.date: 08/30/2017 +

**Connectivity/AllowVPNRoamingOverCellular** @@ -337,6 +450,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ +

Prevents the device from connecting to VPN when the device roams over cellular networks. @@ -349,6 +471,7 @@ ms.date: 08/30/2017 +

**Connectivity/DiablePrintingOverHTTP** @@ -375,6 +498,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!TIP] @@ -393,6 +525,7 @@ ADMX Info: +
**Connectivity/DisableDownloadingOfPrintDriversOverHTTP** @@ -419,6 +552,15 @@ ADMX Info: + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!TIP] @@ -437,6 +579,7 @@ ADMX Info: +
**Connectivity/DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards** @@ -463,6 +606,15 @@ ADMX Info: + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!TIP] @@ -481,6 +633,7 @@ ADMX Info: +
**Connectivity/HardenedUNCPaths** @@ -507,6 +660,15 @@ ADMX Info: + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + This policy setting configures secure access to UNC paths. @@ -529,6 +691,7 @@ ADMX Info: +
**Connectivity/ProhibitInstallationAndConfigurationOfNetworkBridge** @@ -555,6 +718,15 @@ ADMX Info: + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!TIP] diff --git a/windows/client-management/mdm/policy-csp-credentialproviders.md b/windows/client-management/mdm/policy-csp-credentialproviders.md index e253febdf8..5274de917b 100644 --- a/windows/client-management/mdm/policy-csp-credentialproviders.md +++ b/windows/client-management/mdm/policy-csp-credentialproviders.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 08/30/2017 +ms.date: 09/29/2017 --- # Policy CSP - CredentialProviders @@ -14,11 +14,24 @@ ms.date: 08/30/2017 > [!WARNING] > Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -
+ ## CredentialProviders policies +
+
+ CredentialProviders/AllowPINLogon +
+
+ CredentialProviders/BlockPicturePassword +
+
+ CredentialProviders/DisableAutomaticReDeploymentCredentials +
+
+ +
**CredentialProviders/AllowPINLogon** @@ -45,6 +58,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + This policy setting allows you to control whether a domain user can sign in using a convenience PIN. @@ -73,6 +95,7 @@ ADMX Info: +
**CredentialProviders/BlockPicturePassword** @@ -99,6 +122,15 @@ ADMX Info: + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + This policy setting allows you to control whether a domain user can sign in using a picture password. @@ -125,6 +157,7 @@ ADMX Info: +
**CredentialProviders/DisableAutomaticReDeploymentCredentials** @@ -151,6 +184,15 @@ ADMX Info: + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + Added in Windows 10, version 1709. Boolean policy to disable the visibility of the credential provider that triggers the PC refresh on a device. This policy does not actually trigger the refresh. The admin user is required to authenticate to trigger the refresh on the target device. diff --git a/windows/client-management/mdm/policy-csp-credentialsui.md b/windows/client-management/mdm/policy-csp-credentialsui.md index 15d68cf69e..1b7955f4e5 100644 --- a/windows/client-management/mdm/policy-csp-credentialsui.md +++ b/windows/client-management/mdm/policy-csp-credentialsui.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 08/30/2017 +ms.date: 09/29/2017 --- # Policy CSP - CredentialsUI @@ -14,11 +14,21 @@ ms.date: 08/30/2017 > [!WARNING] > Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -
+ ## CredentialsUI policies +
+
+ CredentialsUI/DisablePasswordReveal +
+
+ CredentialsUI/EnumerateAdministrators +
+
+ +
**CredentialsUI/DisablePasswordReveal** @@ -45,6 +55,16 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
+ + This policy setting allows you to configure the display of the password reveal button in password entry user experiences. @@ -73,6 +93,7 @@ ADMX Info: +
**CredentialsUI/EnumerateAdministrators** @@ -99,6 +120,15 @@ ADMX Info: + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + This policy setting controls whether administrator accounts are displayed when a user attempts to elevate a running application. By default, administrator accounts are not displayed when the user attempts to elevate a running application. diff --git a/windows/client-management/mdm/policy-csp-cryptography.md b/windows/client-management/mdm/policy-csp-cryptography.md index eef7cdeba4..9c5f328c19 100644 --- a/windows/client-management/mdm/policy-csp-cryptography.md +++ b/windows/client-management/mdm/policy-csp-cryptography.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 08/30/2017 +ms.date: 09/29/2017 --- # Policy CSP - Cryptography @@ -14,11 +14,21 @@ ms.date: 08/30/2017 > [!WARNING] > Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -
+ ## Cryptography policies +
+
+ Cryptography/AllowFipsAlgorithmPolicy +
+
+ Cryptography/TLSCipherSuites +
+
+ +
**Cryptography/AllowFipsAlgorithmPolicy** @@ -45,6 +55,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ +

Allows or disallows the Federal Information Processing Standard (FIPS) policy. @@ -55,6 +74,7 @@ ms.date: 08/30/2017 +

**Cryptography/TLSCipherSuites** @@ -81,6 +101,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ +

Lists the Cryptographic Cipher Algorithms allowed for SSL connections. Format is a semicolon delimited list. Last write win. diff --git a/windows/client-management/mdm/policy-csp-dataprotection.md b/windows/client-management/mdm/policy-csp-dataprotection.md index edba750722..1261f2c311 100644 --- a/windows/client-management/mdm/policy-csp-dataprotection.md +++ b/windows/client-management/mdm/policy-csp-dataprotection.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 08/30/2017 +ms.date: 09/29/2017 --- # Policy CSP - DataProtection @@ -14,11 +14,21 @@ ms.date: 08/30/2017 > [!WARNING] > Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -

+ ## DataProtection policies +
+
+ DataProtection/AllowDirectMemoryAccess +
+
+ DataProtection/LegacySelectiveWipeID +
+
+ +
**DataProtection/AllowDirectMemoryAccess** @@ -45,6 +55,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ +

This policy setting allows you to block direct memory access (DMA) for all hot pluggable PCI downstream ports until a user logs into Windows. Once a user logs in, Windows will enumerate the PCI devices connected to the host plug PCI ports. Every time the user locks the machine, DMA will be blocked on hot plug PCI ports with no children devices until the user logs in again. Devices which were already enumerated when the machine was unlocked will continue to function until unplugged. This policy setting is only enforced when BitLocker or device encryption is enabled. @@ -57,6 +76,7 @@ ms.date: 08/30/2017 +

**DataProtection/LegacySelectiveWipeID** @@ -83,6 +103,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!IMPORTANT] > This policy may change in a future release. It may be used for testing purposes, but should not be used in a production environment at this time. diff --git a/windows/client-management/mdm/policy-csp-datausage.md b/windows/client-management/mdm/policy-csp-datausage.md index a8724cc2f6..540a7d26a6 100644 --- a/windows/client-management/mdm/policy-csp-datausage.md +++ b/windows/client-management/mdm/policy-csp-datausage.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 08/30/2017 +ms.date: 09/29/2017 --- # Policy CSP - DataUsage @@ -14,11 +14,21 @@ ms.date: 08/30/2017 > [!WARNING] > Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -
+ ## DataUsage policies +
+
+ DataUsage/SetCost3G +
+
+ DataUsage/SetCost4G +
+
+ +
**DataUsage/SetCost3G** @@ -45,6 +55,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + This policy setting configures the cost of 3G connections on the local machine. @@ -75,6 +94,7 @@ ADMX Info: +
**DataUsage/SetCost4G** @@ -101,6 +121,15 @@ ADMX Info: + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + This policy setting configures the cost of 4G connections on the local machine. diff --git a/windows/client-management/mdm/policy-csp-defender.md b/windows/client-management/mdm/policy-csp-defender.md index 3f35e2d4eb..9d75a9f6fa 100644 --- a/windows/client-management/mdm/policy-csp-defender.md +++ b/windows/client-management/mdm/policy-csp-defender.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 08/30/2017 +ms.date: 09/29/2017 --- # Policy CSP - Defender @@ -14,11 +14,120 @@ ms.date: 08/30/2017 > [!WARNING] > Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -
+ ## Defender policies +
+
+ Defender/AllowArchiveScanning +
+
+ Defender/AllowBehaviorMonitoring +
+
+ Defender/AllowCloudProtection +
+
+ Defender/AllowEmailScanning +
+
+ Defender/AllowFullScanOnMappedNetworkDrives +
+
+ Defender/AllowFullScanRemovableDriveScanning +
+
+ Defender/AllowIOAVProtection +
+
+ Defender/AllowIntrusionPreventionSystem +
+
+ Defender/AllowOnAccessProtection +
+
+ Defender/AllowRealtimeMonitoring +
+
+ Defender/AllowScanningNetworkFiles +
+
+ Defender/AllowScriptScanning +
+
+ Defender/AllowUserUIAccess +
+
+ Defender/AttackSurfaceReductionOnlyExclusions +
+
+ Defender/AttackSurfaceReductionRules +
+
+ Defender/AvgCPULoadFactor +
+
+ Defender/CloudBlockLevel +
+
+ Defender/CloudExtendedTimeout +
+
+ Defender/ControlledFolderAccessAllowedApplications +
+
+ Defender/ControlledFolderAccessProtectedFolders +
+
+ Defender/DaysToRetainCleanedMalware +
+
+ Defender/EnableControlledFolderAccess +
+
+ Defender/EnableNetworkProtection +
+
+ Defender/ExcludedExtensions +
+
+ Defender/ExcludedPaths +
+
+ Defender/ExcludedProcesses +
+
+ Defender/PUAProtection +
+
+ Defender/RealTimeScanDirection +
+
+ Defender/ScanParameter +
+
+ Defender/ScheduleQuickScanTime +
+
+ Defender/ScheduleScanDay +
+
+ Defender/ScheduleScanTime +
+
+ Defender/SignatureUpdateInterval +
+
+ Defender/SubmitSamplesConsent +
+
+ Defender/ThreatSeverityDefaultAction +
+
+ +
**Defender/AllowArchiveScanning** @@ -45,6 +154,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 for desktop. @@ -59,6 +177,7 @@ ms.date: 08/30/2017 +
**Defender/AllowBehaviorMonitoring** @@ -85,6 +204,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 for desktop. @@ -99,6 +227,7 @@ ms.date: 08/30/2017 +
**Defender/AllowCloudProtection** @@ -125,6 +254,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 for desktop. @@ -139,6 +277,7 @@ ms.date: 08/30/2017 +
**Defender/AllowEmailScanning** @@ -165,6 +304,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 for desktop. @@ -179,6 +327,7 @@ ms.date: 08/30/2017 +
**Defender/AllowFullScanOnMappedNetworkDrives** @@ -205,6 +354,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 for desktop. @@ -219,6 +377,7 @@ ms.date: 08/30/2017 +
**Defender/AllowFullScanRemovableDriveScanning** @@ -245,6 +404,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 for desktop. @@ -259,6 +427,7 @@ ms.date: 08/30/2017 +
**Defender/AllowIOAVProtection** @@ -285,6 +454,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 for desktop. @@ -299,6 +477,7 @@ ms.date: 08/30/2017 +
**Defender/AllowIntrusionPreventionSystem** @@ -325,6 +504,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 for desktop. @@ -339,6 +527,7 @@ ms.date: 08/30/2017 +
**Defender/AllowOnAccessProtection** @@ -365,6 +554,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 for desktop. @@ -379,6 +577,7 @@ ms.date: 08/30/2017 +
**Defender/AllowRealtimeMonitoring** @@ -405,6 +604,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 for desktop. @@ -419,6 +627,7 @@ ms.date: 08/30/2017 +
**Defender/AllowScanningNetworkFiles** @@ -445,6 +654,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 for desktop. @@ -459,6 +677,7 @@ ms.date: 08/30/2017 +
**Defender/AllowScriptScanning** @@ -485,6 +704,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 for desktop. @@ -499,6 +727,7 @@ ms.date: 08/30/2017 +
**Defender/AllowUserUIAccess** @@ -525,6 +754,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 for desktop. @@ -539,6 +777,7 @@ ms.date: 08/30/2017 +
**Defender/AttackSurfaceReductionOnlyExclusions** @@ -565,6 +804,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 for desktop. @@ -576,6 +824,7 @@ ms.date: 08/30/2017 +
**Defender/AttackSurfaceReductionRules** @@ -602,6 +851,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 for desktop. @@ -615,6 +873,7 @@ ms.date: 08/30/2017 +
**Defender/AvgCPULoadFactor** @@ -641,6 +900,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 for desktop. @@ -654,6 +922,7 @@ ms.date: 08/30/2017 +
**Defender/CloudBlockLevel** @@ -680,6 +949,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 for desktop. @@ -703,6 +981,7 @@ ms.date: 08/30/2017 +
**Defender/CloudExtendedTimeout** @@ -729,6 +1008,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 for desktop. @@ -744,6 +1032,7 @@ ms.date: 08/30/2017 +
**Defender/ControlledFolderAccessAllowedApplications** @@ -770,6 +1059,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 for desktop. The previous name was GuardedFoldersAllowedApplications and changed to ControlledFolderAccessAllowedApplications. @@ -778,6 +1076,7 @@ ms.date: 08/30/2017 +
**Defender/ControlledFolderAccessProtectedFolders** @@ -804,6 +1103,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 for desktop. The previous name was GuardedFoldersList and changed to ControlledFolderAccessProtectedFolders. @@ -812,6 +1120,7 @@ ms.date: 08/30/2017 +
**Defender/DaysToRetainCleanedMalware** @@ -838,6 +1147,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 for desktop. @@ -851,6 +1169,7 @@ ms.date: 08/30/2017 +
**Defender/EnableControlledFolderAccess** @@ -877,6 +1196,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 for desktop. The previous name was EnableGuardMyFolders and changed to EnableControlledFolderAccess. @@ -889,6 +1217,7 @@ ms.date: 08/30/2017 +
**Defender/EnableNetworkProtection** @@ -915,6 +1244,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 for desktop. @@ -935,6 +1273,7 @@ ms.date: 08/30/2017 +
**Defender/ExcludedExtensions** @@ -961,6 +1300,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 for desktop. @@ -970,6 +1318,7 @@ ms.date: 08/30/2017 +
**Defender/ExcludedPaths** @@ -996,6 +1345,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 for desktop. @@ -1005,6 +1363,7 @@ ms.date: 08/30/2017 +
**Defender/ExcludedProcesses** @@ -1031,6 +1390,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 for desktop. @@ -1046,6 +1414,7 @@ ms.date: 08/30/2017 +
**Defender/PUAProtection** @@ -1072,6 +1441,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 for desktop. @@ -1087,6 +1465,7 @@ ms.date: 08/30/2017 +
**Defender/RealTimeScanDirection** @@ -1113,6 +1492,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 for desktop. @@ -1132,6 +1520,7 @@ ms.date: 08/30/2017 +
**Defender/ScanParameter** @@ -1158,6 +1547,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 for desktop. @@ -1172,6 +1570,7 @@ ms.date: 08/30/2017 +
**Defender/ScheduleQuickScanTime** @@ -1198,6 +1597,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 for desktop. @@ -1217,6 +1625,7 @@ ms.date: 08/30/2017 +
**Defender/ScheduleScanDay** @@ -1243,6 +1652,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 for desktop. @@ -1268,6 +1686,7 @@ ms.date: 08/30/2017 +
**Defender/ScheduleScanTime** @@ -1294,6 +1713,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 for desktop. @@ -1313,6 +1741,7 @@ ms.date: 08/30/2017 +
**Defender/SignatureUpdateInterval** @@ -1339,6 +1768,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 for desktop. @@ -1354,6 +1792,7 @@ ms.date: 08/30/2017 +
**Defender/SubmitSamplesConsent** @@ -1380,6 +1819,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 for desktop. @@ -1396,6 +1844,7 @@ ms.date: 08/30/2017 +
**Defender/ThreatSeverityDefaultAction** @@ -1422,6 +1871,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 for desktop. diff --git a/windows/client-management/mdm/policy-csp-deliveryoptimization.md b/windows/client-management/mdm/policy-csp-deliveryoptimization.md index e352718a5d..f001c4ea3e 100644 --- a/windows/client-management/mdm/policy-csp-deliveryoptimization.md +++ b/windows/client-management/mdm/policy-csp-deliveryoptimization.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 08/30/2017 +ms.date: 09/29/2017 --- # Policy CSP - DeliveryOptimization @@ -14,11 +14,63 @@ ms.date: 08/30/2017 > [!WARNING] > Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -
+ ## DeliveryOptimization policies +
+
+ DeliveryOptimization/DOAbsoluteMaxCacheSize +
+
+ DeliveryOptimization/DOAllowVPNPeerCaching +
+
+ DeliveryOptimization/DODownloadMode +
+
+ DeliveryOptimization/DOGroupId +
+
+ DeliveryOptimization/DOMaxCacheAge +
+
+ DeliveryOptimization/DOMaxCacheSize +
+
+ DeliveryOptimization/DOMaxDownloadBandwidth +
+
+ DeliveryOptimization/DOMaxUploadBandwidth +
+
+ DeliveryOptimization/DOMinBackgroundQos +
+
+ DeliveryOptimization/DOMinBatteryPercentageAllowedToUpload +
+
+ DeliveryOptimization/DOMinDiskSizeAllowedToPeer +
+
+ DeliveryOptimization/DOMinFileSizeToCache +
+
+ DeliveryOptimization/DOMinRAMAllowedToPeer +
+
+ DeliveryOptimization/DOModifyCacheDrive +
+
+ DeliveryOptimization/DOMonthlyUploadDataCap +
+
+ DeliveryOptimization/DOPercentageMaxDownloadBandwidth +
+
+ +
**DeliveryOptimization/DOAbsoluteMaxCacheSize** @@ -45,6 +97,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 Pro, Enterprise, and Education editions and not supported in Windows 10 Mobile. @@ -56,6 +117,7 @@ ms.date: 08/30/2017 +
**DeliveryOptimization/DOAllowVPNPeerCaching** @@ -82,6 +144,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 Pro, Enterprise, and Education editions and not supported in Windows 10 Mobile. @@ -93,6 +164,7 @@ ms.date: 08/30/2017 +
**DeliveryOptimization/DODownloadMode** @@ -119,6 +191,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 Pro, Enterprise, and Education editions and not supported in Windows 10 Mobile. @@ -137,6 +218,7 @@ ms.date: 08/30/2017 +
**DeliveryOptimization/DOGroupId** @@ -163,6 +245,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 Pro, Enterprise, and Education editions and not supported in Windows 10 Mobile. @@ -175,6 +266,7 @@ ms.date: 08/30/2017 +
**DeliveryOptimization/DOMaxCacheAge** @@ -201,6 +293,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 Pro, Enterprise, and Education editions and not supported in Windows 10 Mobile. @@ -212,6 +313,7 @@ ms.date: 08/30/2017 +
**DeliveryOptimization/DOMaxCacheSize** @@ -238,6 +340,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 Pro, Enterprise, and Education editions and not supported in Windows 10 Mobile. @@ -249,6 +360,7 @@ ms.date: 08/30/2017 +
**DeliveryOptimization/DOMaxDownloadBandwidth** @@ -275,6 +387,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 Pro, Enterprise, and Education editions and not supported in Windows 10 Mobile. @@ -286,6 +407,7 @@ ms.date: 08/30/2017 +
**DeliveryOptimization/DOMaxUploadBandwidth** @@ -312,6 +434,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 Pro, Enterprise, and Education editions and not supported in Windows 10 Mobile. @@ -323,6 +454,7 @@ ms.date: 08/30/2017 +
**DeliveryOptimization/DOMinBackgroundQos** @@ -349,6 +481,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 Pro, Enterprise, and Education editions and not supported in Windows 10 Mobile. @@ -360,6 +501,7 @@ ms.date: 08/30/2017 +
**DeliveryOptimization/DOMinBatteryPercentageAllowedToUpload** @@ -386,6 +528,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 Pro, Business, Enterprise, and Education editions and not supported in Windows 10 Mobile. @@ -396,6 +547,7 @@ ms.date: 08/30/2017 +
**DeliveryOptimization/DOMinDiskSizeAllowedToPeer** @@ -422,6 +574,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 Pro, Business, Enterprise, and Education editions and not supported in Windows 10 Mobile. @@ -436,6 +597,7 @@ ms.date: 08/30/2017 +
**DeliveryOptimization/DOMinFileSizeToCache** @@ -462,6 +624,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 Pro, Business, Enterprise, and Education editions and not supported in Windows 10 Mobile. @@ -473,6 +644,7 @@ ms.date: 08/30/2017 +
**DeliveryOptimization/DOMinRAMAllowedToPeer** @@ -499,6 +671,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 Pro, Business, Enterprise, and Education editions and not supported in Windows 10 Mobile. @@ -510,6 +691,7 @@ ms.date: 08/30/2017 +
**DeliveryOptimization/DOModifyCacheDrive** @@ -536,6 +718,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 Pro, Enterprise, and Education editions and not supported in Windows 10 Mobile. @@ -547,6 +738,7 @@ ms.date: 08/30/2017 +
**DeliveryOptimization/DOMonthlyUploadDataCap** @@ -573,6 +765,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 Pro, Enterprise, and Education editions and not supported in Windows 10 Mobile. @@ -586,6 +787,7 @@ ms.date: 08/30/2017 +
**DeliveryOptimization/DOPercentageMaxDownloadBandwidth** @@ -612,6 +814,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + > [!NOTE] > This policy is only enforced in Windows 10 Pro, Enterprise, and Education editions and not supported in Windows 10 Mobile. diff --git a/windows/client-management/mdm/policy-csp-desktop.md b/windows/client-management/mdm/policy-csp-desktop.md index 8a3b89d0f5..8d89bebfb5 100644 --- a/windows/client-management/mdm/policy-csp-desktop.md +++ b/windows/client-management/mdm/policy-csp-desktop.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 08/30/2017 +ms.date: 09/29/2017 --- # Policy CSP - Desktop @@ -14,11 +14,18 @@ ms.date: 08/30/2017 > [!WARNING] > Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -
+ ## Desktop policies +
+
+ Desktop/PreventUserRedirectionOfProfileFolders +
+
+ +
**Desktop/PreventUserRedirectionOfProfileFolders** @@ -45,6 +52,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + Prevents users from changing the path to their profile folders. diff --git a/windows/client-management/mdm/policy-csp-deviceguard.md b/windows/client-management/mdm/policy-csp-deviceguard.md index df77a218e7..b45125a146 100644 --- a/windows/client-management/mdm/policy-csp-deviceguard.md +++ b/windows/client-management/mdm/policy-csp-deviceguard.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 08/30/2017 +ms.date: 09/29/2017 --- # Policy CSP - DeviceGuard @@ -14,11 +14,24 @@ ms.date: 08/30/2017 > [!WARNING] > Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -
+ ## DeviceGuard policies +
+
+ DeviceGuard/EnableVirtualizationBasedSecurity +
+
+ DeviceGuard/LsaCfgFlags +
+
+ DeviceGuard/RequirePlatformSecurityFeatures +
+
+ +
**DeviceGuard/EnableVirtualizationBasedSecurity** @@ -45,6 +58,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ +  

Added in Windows 10, version 1709. Turns on virtualization based security(VBS) at the next reboot. virtualization based security uses the Windows Hypervisor to provide support for security services. Value type is integer. Supported values: @@ -55,6 +77,7 @@ ms.date: 08/30/2017 +

**DeviceGuard/LsaCfgFlags** @@ -81,6 +104,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ +  

Added in Windows 10, version 1709. This setting lets users turn on Credential Guard with virtualization-based security to help protect credentials at next reboot. Value type is integer. Supported values: @@ -93,6 +125,7 @@ ms.date: 08/30/2017 +

**DeviceGuard/RequirePlatformSecurityFeatures** @@ -119,6 +152,15 @@ ms.date: 08/30/2017 + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + Added in Windows 10, version 1709. Specifies the platform security level at the next reboot. Value type is integer. Supported values: